Complete the GCP Sensor Setup

USM Anywhere automatically discovers a number of out-of-box logs as long as you have enabled them within your GCP subscription. See GCP Log Discovery and Collection in USM Anywhere for more information about these logs and how they function within the GCP environment.

To enable the out-of-box log collection jobs

1. Locate the job you want to enable and click .

   This turns the icon green ().

   

2. Click Next.

USM Anywhere uses subscriptions to collect log data from your environment and produce the corresponding events and alarms. See GCP Log Discovery and Collection in USM Anywhere for more information about enabling these subscriptions and how they function within the GCP environment.

To enable the out-of-box log subscriptions

1. Locate the job you want to enable and click enable.

   This displays the text as disable.

If you don't yet have any subscriptions in your GCP environment, this table will be empty at this step. The steps in GCP Log Discovery and Collection in USM Anywhere will create the subscriptions your sensor needs for Google Cloud Pub/Sub.

The optional Active Directory (AD) Active Directory (AD) is a directory service that Microsoft developed for Windows domain networks. setup page configures USM Anywhere to collect information from your AD account. To monitor Microsoft Windows systems effectively, USM Anywhere needs access to the AD server to collect inventory information.

LevelBlue recommends that you create a dedicated AD account with membership in the Domain Admins group to be used by USM Anywhere to log in to the Windows systems. You also need to activate Microsoft Windows Remote Management (WinRM) in the domain controller and in all the hosts that you want to scan. You can do this by using a group policy for all the systems in your AD.

To complete the AD access configuration

1. Provide the AD credentials for USM Anywhere:

   • Active Directory IP Address: Enter the IP address for the AD server.
   • Username: Enter your username as admin of the account.
   • Password: Enter your admin's password.
   • Domain: Enter the domain for the AD instance.

   

2. Click Scan Active Directory.

   After a successful launch of the scan, a confirmation dialog box opens.

   

3. Click Accept.

   The scan continues in the background.

   Upon completion, another dialog box opens and provides information about the number of assets USM Anywhere discovered. It also prompts you to decide if you want to scan for hosts and services running in your environment.

   

   Click Cancel to opt out of this scan.

4. (Optional.) If you want to scan for other hosts and services, click OK.

5. Click Next after the scan ends.

On the Log Management page are syslog port numbers. (These ports are the same for all USM Anywhere Sensors.)

USM Anywhere collects third-party device, system, and application data through syslog An industry standard message logging system that is used on many devices and platforms. over UDP on port 514 and over TCP on ports 601 or 602 by default. It collects Transport Layer Security (TLS)-encrypted Transport layer security. Successor to Secure Sockets Layer (SSL) protocol. Provides security for communication over the Internet between client and server applications. data through TCP on ports 6514 or 6515 by default. These ports support the RFC 3164 and RFC 5424 formats. To configure any third-party devices to send data to USM Anywhere, you must provide the IP address and the port number of your USM Anywhere Sensor.

To enable log collection and configure your log management

1. Make sure that you have granted the necessary permissions for your OS to allow USM Anywhere to access its logs. You can also integrate a wide variety of data sources to send log data over syslog to the USM Anywhere Sensor.

   To learn how to configure your operating systems and supported third-party devices to forward syslog log data, see the following related topics:

• The Syslog Server Sensor App: Log collection (UDP, TCP, and TLS-encrypted TCP) from rsyslog
• Collecting Linux System Logs: Log collection from a Linux system
• Collecting Windows System Logs: Log collection from a Windows system
• Go to the specific BlueApp in USM Anywhere for instructions about syslog forwarding

Note: Because the log scan can take some time, you might not see all of the automatically discovered log sources immediately after deploying the first USM Anywhere Sensor.

2. When you have finished the log collection setup and integrated any needed plugins, verify that the data transfer is occurring.
3. Click Next when this step is complete.

LevelBlue Labs™ Open Threat Exchange® (OTX™) is an open information-sharing and analysis network providing users with the ability to collaborate, research, and receive alerts on emerging threats and indicators of compromise (IoCs) such as IP addresses, file hashes, and domains.

You must have an OTX account to receive alerts based on threats identified in OTX. This account is separate from your USM Anywhere account. Go to The World’s First Truly Open Threat Intelligence Community to create an OTX account.

To enable USM Anywhere to evaluate event data against the latest OTX intelligence

1. Log in to OTX and open the API page (https://otx.alienvault.com/api).

2. In the DirectConnect API Usage pane, click the icon to copy your unique OTX connection key.

   

3. Return to the Open Threat Exchange (OTX) page of the USM Anywhere Sensor Setup Wizard and paste the value in the OTX Key text box.

   

4. Click Validate OTX Subscription Key.

   With a successful validation of the key, the status at the top of the page changes to "Valid OTX key".

5. Click Next when this task is complete.

The Congratulations page summarizes the status of your configuration.

Click Start Using USM Anywhere, which takes you to the Overview dashboard.