USM Anywhere™

Configuring the AlienApp for AT&T Cybersecurity Forensics and Response

To use the AlienApp for AT&T Cybersecurity Forensics and Response for data collection and enforcement functions on remotes hosts, the target assets must meet the following requirements:

See System Settings for Authenticated Scans for information about configuring the host system to support remote management functions.

Access Rights for Credentials

USM Anywhere requires privileged access to execute system-level functions for monitored assets. Using an unprivileged account results in many "unknown" and potentially some "error" results. Make sure that you have credentials for the target assets that meet the following requirements:

  • For Windows systems, USM Anywhere uses Microsoft Windows Remote Management (WinRM) framework (version 2.0 or higher) to execute the corresponding commands. Therefore, if WinRM is unavailable on a target Windows system through the account credentials, USM Anywhere will be unable to connect.

    Important: Only the members of the Remote Management Users and Administrators groups can log in through Web Services for Management (WS-Management).

  • For Linux systems, USM Anywhere connects to the target host through SSH to run the supported functions. USM Anywhere supports the definition of credentials with sudo privilege escalation. It also supports login as a particular user followed by a su privilege escalation, which executes every command as a root user.

Note: USM Anywhere also supports credentials for Cisco IOS to support authenticated scans on those devices. This credential type is not used by the AlienApp for AT&T Cybersecurity Forensics and Response.

Manage Credentials for Your Assets

Before you use the AlienApp for AT&T Cybersecurity Forensics and Response actions to perform collection and enforcement functions for your assets, you should make sure that each of the assets has assigned credentials that are able to connect to the system. In USM Anywhere, you can assign credentials for an individual asset An IP-addressable host, including but not limited to network devices, virtual servers, and physical servers. or for an asset group Asset groups are administratively created objects that group similar assets for specific purposes..

Note: Credentials assigned directly to an asset have higher priority than those assigned to an asset group.

When USM Anywhere runs a scan or executes a system-level action, it uses the credential set assigned directly to the asset, if there is one. If those credentials don't connect or the asset doesn't have an assigned credential set, it uses the credential set assigned to the group where the asset is a member, if that asset is a member of an asset group.

To add a new credential

  1. Go to Settings > Credentials.

    Credentials main page

  2. Click New Credentials.

    The Add New Credential dialog box opens.

    Add a new credential set for system-level access to USM Anywhere assets

  3. Enter a name for the credential in the Name field and, if desired, a description to clarify its use in the Description field.
  4. In Credential Type, select SSH Program to securely log into another computer over a network, execute commands in a remote machine, and move files from one machine to another through Secure Copy (SCP). or Windows RM based on the operating system Software that manages computer hardware resources and provides common services for computer programs. Examples include Microsoft Windows, Macintosh OS X, UNIX, and Linux. of the asset.

  5. Click Save.

In USM Anywhere, you assign a defined credential set to an individual asset in order to use the credentials for authenticated scans, active directory (AD) scans, and AlienApp for Forensics and Response actions on the host. You can assign assets to a credential set in the Credentials page, or you can perform this task from the Assets page.

To assign a credential on the Credentials page

  1. Go to Settings > Credentials.
  2. In the line of the credential you want to assign, click the icon.

    Click the Usage icon to manage the asset assignments for the credential set

    A dialog box opens.

    Manage Assets Dialog Box

  3. Enter part of the asset name in the field at the bottom of the dialog box

    Enter part of the asset name and select it from the list of matching items

    This displays the matching items below the field. You can enter more text to filter the list further.

  4. Select the asset to assign to the credential set.

    The credentials overwrite dialog box opens.

    Credentials Overwrite Dialog Box

    Warning: If the asset has already assigned credentials, these credentials are going to be overwritten.

  5. Next to the displayed asset name, click Test to execute a test connection to the asset using the credentials.

    If the test detects any warnings, a Permissions Warnings section displays. This section contains a Warning column that lists the individual warnings.

    Testing Credentials

    A permissions error doesn't prevent the scan from running, but it can result in the incomplete information being detailed in the scan results.

  6. Click the icon to close the dialog box.

To assign a credential on the Assets page

  1. Go to Environment > Assets and locate the asset.
  2. Next to the asset name, click the icon and select Assign Credentials.

    The assign credentials dialog box opens.

    Assign Credentials

  3. In the Available Credentials drop-down list, select the credential to use.

    Assign Credentials

  4. Note: If the needed credentials do not already exist, you can select Add New Credentials to define them in USM Anywhere. See Creating Credentials for more information. Use the icon to modify any information.

  5. (Optional.) Select the Jump Box option if you want to authenticate through another asset.

    Select the checkbox and use the field to search for the asset you want to use as an authentication server.

  6. Click Test to execute a test connection to the asset using the selected credentials.

    If the test detects any warnings, a Permissions Warnings section displays. This section contains a Warning column that lists the individual warnings and a Remediation that provides a suggested solution to resolve each warning. A permissions error doesn't prevent the scan from running, but it can result in the incomplete information being detailed in the scan results.

  7. Click Save.

In USM Anywhere, you assign a defined credential set to an asset group to use the credentials for authenticated scans, AD scans, and AlienApp Forensics and Response actions on members of the group. You can assign asset groups to a credential set in the Credentials page, or you can perform this task from the Asset Groups page.

Important: When you assign a credential to an asset group, USM Anywhere assigns the credential to the asset group instead of assigning it to all of its members.

To assign a credential on the Credentials page

  1. Go to Settings > Credentials.
  2. In the line of the credential you want to assign, click the icon.

    Click the Usage icon to manage the asset assignments for the credential set

    A dialog box opens.

    Manage Assets Dialog Box

  3. Click the Asset Groups tab.
  4. At the bottom of the dialog box, enter part of the asset group name in the field.
  5. This displays the matching items below the field. You can enter more text to filter the list further.

  6. Select the asset group to assign to the credential set.

    Enter part of the asset group name and select it from the list of matching items

  7. After you select the asset group, the dialog displays the item at the top. If needed, you can enter text for another asset group name and select it to assign multiple asset groups for the credential set.

  8. Click the icon to close the dialog box.

To assign a credential on the Asset Groups page

  1. Go to Environment > Asset Groups.
  2. Next to the asset name, click the icon and select Assign Credentials.

    The assign credentials dialog box opens.

    Assign Credentials

  3. In the Available Credentials drop-down list, select the credential to use.

  4. Note: If the needed credentials do not already exist, you can select Add New Credentials to define them in USM Anywhere. Use the icon to modify any information. Click Remove Current Credentials From Asset Group to remove that credential from the asset group.

  5. Click Save.