USM Anywhere™

AlienVault Agent Deployment

To install the AlienVault Agent on your hosts, generate an installation script in USM Anywhere that is specific to your USM Anywhere environment. When you run the installation script on the host system, the installed agent automatically registers with your USM Anywhere instance and configures the system to automatically collect data from the endpoint for threat detection. AT&T Cybersecurity recommends that the host system has a minimum of 4 GB memory and 2 CPU cores for the agent. See Windows, Linux, or macOS installation for operating system-specific requirements.

The AlienVault Agent uses osquery. Other endpoint security products may use osquery for similar tasks, perhaps with different paths or file locations. In theory, osquery running under a different process or service name should present no issues, but AT&T Cybersecurity doesn't support installing a second agent that uses osquery. Additionally, it may be necessary to whitelist the service or process that the AlienVault Agent uses in other endpoint security products so that the AlienVault Agent can operate normally. The following table lists the osquery service and process used by the AlienVault Agent and the AlienVault Agent script.

osquery Service and Process Used by the AlienVault Agent
USM Anywhere Component Platform osquery Service osquery Process
AlienVault Agent Linux osqueryd osqueryd
  macOS osqueryd osqueryd
  Windows osqueryd osqueryd.exe
AlienVault Agent Script Linux N/A osqueryi
  macOS N/A osqueryi
  Windows N/A osqueryi.exe

Agent Deployment Details

The Agents page (Data Sources > Agents) provides an overview of your deployed AlienVault Agents.

Click the displayed numbers to view a list of the items in the Assets page. If there are unassociated agents, this page displays an alert to help you resolve them. See AlienVault Agent and Asset Associations for more information.

Access the Agents page to review high-level information about deployed AlienVault Agents

Agent Data Collection

Each AlienVault Agent must be associated with an asset An IP-addressable host, including but not limited to network devices, virtual servers, and physical servers. in USM Anywhere to enable log collection, which should match the host system where it is deployed. When this association is in place, detailed information is available in the Asset Details page. On this page, you can view the number of events Any traffic or data exchange detected by AT&T Cybersecurity products through a sensor, or through external devices such as a firewall. associated with the agent, as well as data consumption by the agent over a fixed period of time. See Viewing Assets Details for more information.

When the agent is registered and associated with an asset, the agent configuration profile determines the queries and intervals that USM Anywhere uses to collect logs from the host system.

The agent dashboard displays status information for all agents registered with your USM Anywhere environment, including an indication that an agent is currently sending data. See AlienVault Agent Dashboard for more information.