USM Anywhere™

Adding a New Sensor

Role Availability Read-Only Analyst Manager

After your USM Anywhere service is provisioned and running, you can add and deploy new sensors as needed. For these sensors, instead of receiving an authentication code from AT&T Cybersecurity, you must generate the license key for any new sensor you intend to add from within the USM Anywhere web user interface (UI). The rest of the sensor deployment process is the same as the first one.

You can add as many sensorsSensors are deployed into an on-premises, cloud, or multi-cloud environment to collect log and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation. as you need in your environment, according to your USM Anywhere license.

To check your allowed USM Anywhere Sensors

  1. Go to Settings > My Subscription to open the page.
  2. Check the allowed sensors you have and the license end date. The displayed date depends on your computer's time zone.

    My Subscription Main Page

Note: If you want to modify your USM Anywhere License, please contact the AlienVault Sales department.

To add a new sensor

Note: If your USM Anywhere License does not allow you to create more sensors, this button will remain inactive.

  1. Deploy your sensor.

    Follow the instructions based on your sensor type:

  2. Obtain an authentication code for the new sensor.
    1. In USM Anywhere, go to Data Sources > Sensors.
    2. Click New Sensor.

      Note: If your USM Anywhere License does not allow you to create more sensors, this button will remain inactive.

      The dialog box displays an authentication code for the new sensor. This code starts with an "S".

      Copy the authentication code for a new USM Anywhere Sensor

    3. Important: This code will expire in 24 hours.

      Note: While the authentication code used for the very first sensor you create begins with a "C", any additional sensors are authenticated with codes beginning with "S".

    4. Click the icon to copy the code to your clipboard.
  3. Register your sensor.

    Click tor enter the URL of your sensor to get to the setup page. It prompts you to provide the following information:

    1. Enter a name and description for the sensor.
    2. In the field with the key icon (), paste the sensor authentication code you copied.
    3. In the field with the computer icon (), copy and paste the URL of your existing instance.

      For example, if the subdomain with which you registered with AT&T Cybersecurity was "mycompany", the URL would be mycompany.alienvault.cloud for USM Anywhere, or mycompany.gov.alienvault.us for AT&T TDR for Gov.

      Enter the sensor authentication code and your USM Anywhere URL/domain

    4. Click Start Setup.

      A progress dialog box displays a status message.

      Connecting USM Anywhere Sensor

      When the connection is complete, a confirmation message opens.

      The system displays a success message and link to your USM Anywhere instance

    5. Click the link to open the USM Anywhere web UI.

      Upon login, this displays the USM Anywhere Sensor Configuration page with the connected sensor listed in the page.

  4. Configure your sensor.

    Follow the instructions based on your sensor type:

    Note: If you do not want to complete the sensor setup immediately, you can click Start Using USM Anywhere at the bottom of the page. However, AT&T Cybersecurity strongly recommends that you do so now, because you must complete the sensor setup before you can use it.

  5. Go to Data Sources > Sensors to open the page.
  6. Check in the list of sensors that your new sensor is on the list, ready, and well-configured.