Adding an Additional Sensor for Other AWS Accounts

Role Availability Read-Only Investigator Analyst Manager

After you set up your initial sensor and USM Anywhere service, you can generate the license key from within USM Anywhere for any new sensor you intend to add for other AWS accounts or to enable log collection from S3 storage to support third-party integrations.

Note: The number of sensors that you can add to your environment depends on your USM Anywhere license. You can go to Settings > My Subscription to view the number of licensed sensors. See Subscription Management for more information.

To add an additional USM Anywhere Sensor to AWS

  1. In USM Anywhere, go to Data Sources > Sensors.

  2. Click New Sensor.

    The dialog box displays an authentication code for the new sensor.

    Copy the authentication code for a new USM Anywhere Sensor

  3. Click the icon to copy the code to your clipboard.

    You should paste this code to another location for use later and keep USM Anywhere open in the background.

  4. Create the sensor stack in your AWS account, as described in Deploy the AWS Sensor.
  5. Use the URL or public IP address to access the USM Anywhere sensor registration, as described in Connect the AWS Sensor to USM Anywhere .

  6. When you get to the Welcome to USM Anywhere Sensor Setup! page, it prompts you to provide the information for registering the additional sensor with your USM Anywhere instance:

    • Enter a Sensor Name and Sensor Description.
    • Paste the sensor authentication code you copied into the field with the icon.

    • Copy the URL of your existing USM Anywhere instance and paste it into the field with the Computer ( ).

      For example, if the subdomain with which you registered with LevelBlue was "mycompany," the URL would be mycompany.alienvault.cloud or mycompany.gov.alienvault.us (for LevelBlue TDR for Gov).

      Enter the sensor authentication code and your USM Anywhere URL/domain

    • Click Start Setup.

      A progress dialog box displays a status message.

      Connecting USM Anywhere Sensor

      When the connection is complete, a Welcome page opens.

      The system displays a success message and link to your USM Anywhere instance

  7. Click the link to open the USM Anywhere web UI.

    Upon login, this displays the USM Anywhere Sensor Configuration page with the connected sensor listed in the page.

    Click Configure to complete the configuration of the connected sensor

  8. Click Configure to complete the sensor setup.

    If you do not want to complete the sensor setup immediately, you can click Start Using USM Anywhere at the bottom of the page. However, you must complete the sensor setup before you can use it.

    Note: Although you can wait to configure the new sensor at a more convenient time, LevelBlue strongly recommends that you do so now.

Related Video Content

To view other related training videos, click here.