Enable Plugins from the Sensor Configuration

Applies to Product: USM Appliance™ LevelBlue OSSIM®

You can enable up to 100 plugins on a USM Appliance Sensor from the USM Appliance web UI or from the LevelBlue Console.

The USM Appliance web UI provides the fastest way to enable plugins on the sensor, particularly, if you have USM Appliance All-in-One.

To enable a plugin on the sensor configuration page in the USM Appliance web UI

  1. In the USM Appliance web UI, go to Configuration > Deployment > Components > AlienVault Center.
  2. Click one of the USM Appliance Sensors.

  3. Click Sensor Configuration > Collection.

    4. Sensor Configuration page with Collection highlighted.

    The left column of the Sensor Configuration page shows the enabled plugins. The right column shows the plugins available for enablement.

  4. Move a plugin from one side to the other in either of these ways:
    • Drag a plugin from one column to the other.
    • Use the links [+] or [-] next to a specific item.
  5. Click Apply Changes.
  6. Configure rsyslog and logrotate. For instructions, see Configure the USM Appliance Sensor to Receive Logs Through Syslog.

You can enable all plugins on the sensor from the LevelBlue Console. However, you may find it's faster to enable plugins through the USM Appliance web UI, if you have USM Appliance All-in-One.

To enable plugins from the LevelBlue Console

  1. Connect to the LevelBlue Console through SSH and use your credentials to log in.

    The LevelBlue Setup menu displays.

  2. Select Configure Sensor.
  3. Select Configure Data Source Plugins.
  4. Use the keyboard arrow keys to move to the plugin, select the plugin by pressing the spacebar, and then press Enter (<OK>).
  5. Press <Back> until you are on the LevelBlue Setup menu again. Select Apply all Changes.

  6. Press <Yes> to confirm.

    USM Appliance applies the changes and restarts all the services, which may take several minutes.

  7. Configure rsyslog and logrotate. For instructions, see Configure the USM Appliance Sensor to Receive Logs Through Syslog.

Note: If you want to confirm that the correct plugin has been enabled, jailbreak the system and open /etc/ossim/agent/config.cfg. The new plugin will appear inside the [plugins] section.