# Add a label to an alarm Source: https://docs.levelblue.com/api-reference/alarms/add-a-label-to-an-alarm /documentation/api-reference/v2.yaml put /alarms/{alarmId}/labels/{labelId} Associates a label with a specific alarm. # Get a page of alarms Source: https://docs.levelblue.com/api-reference/alarms/get-a-page-of-alarms /documentation/api-reference/v2.yaml get /alarms Retrieves a paginated list of alarms. Can be filtered by various parameters. # Get Alarm Details Source: https://docs.levelblue.com/api-reference/alarms/get-alarm-details /documentation/api-reference/v2.yaml get /alarms/{alarmId} Retrieves the full details for a single alarm by its UUID. # List labels for an alarm Source: https://docs.levelblue.com/api-reference/alarms/list-labels-for-an-alarm /documentation/api-reference/v2.yaml get /alarms/{alarmId}/labels Retrieves a list of label IDs associated with a specific alarm. # Remove a label from an alarm Source: https://docs.levelblue.com/api-reference/alarms/remove-a-label-from-an-alarm /documentation/api-reference/v2.yaml delete /alarms/{alarmId}/labels/{labelId} Disassociates a label from a specific alarm. # Create an Attachment Source: https://docs.levelblue.com/api-reference/attachments/create-an-attachment /documentation/api-reference/v3.yaml post /investigations/{investigationId}/attachments Creates an attachment for an investigation. # Delete an Attachment Source: https://docs.levelblue.com/api-reference/attachments/delete-an-attachment /documentation/api-reference/v3.yaml delete /investigations/{investigationId}/attachments/{attachmentId} Removes an attachment from an investigation. # List Attachments Source: https://docs.levelblue.com/api-reference/attachments/list-attachments /documentation/api-reference/v3.yaml get /investigations/{investigationId}/attachments Returns a list of attachments associated with an investigation. # Modify an Attachment Source: https://docs.levelblue.com/api-reference/attachments/modify-an-attachment /documentation/api-reference/v3.yaml put /investigations/{investigationId}/attachments/{attachmentId} Modifies the properties of an attachment. # Obtain an Attachment Source: https://docs.levelblue.com/api-reference/attachments/obtain-an-attachment /documentation/api-reference/v3.yaml get /investigations/{investigationId}/attachments/{attachmentId} Returns an attachment associated with an investigtion. # Get a page of events Source: https://docs.levelblue.com/api-reference/events/get-a-page-of-events /documentation/api-reference/v2.yaml get /events Retrieves a paginated list of events, which can be filtered by various parameters. # Get Event Details Source: https://docs.levelblue.com/api-reference/events/get-event-details /documentation/api-reference/v2.yaml get /events/{eventId} Retrieves the full details for a single event by its UUID. # Add Evidence Source: https://docs.levelblue.com/api-reference/evidence/add-evidence /documentation/api-reference/v3.yaml post /investigations/{investigationId}/evidence Adds a piece of evidence to an investigation. # List Evidence Source: https://docs.levelblue.com/api-reference/evidence/list-evidence /documentation/api-reference/v3.yaml get /investigations/{investigationId}/evidence Returns a list of evidence associated with an investigation. # Obtain Evidence Source: https://docs.levelblue.com/api-reference/evidence/obtain-evidence /documentation/api-reference/v3.yaml get /investigations/{investigationId}/evidence/{evidenceId} Returns a piece of evidence associated with an investigation. # Remove Evidence Source: https://docs.levelblue.com/api-reference/evidence/remove-evidence /documentation/api-reference/v3.yaml delete /investigations/{investigationId}/evidence/{evidenceId} Removes a piece of evidence from an investigation. # List Changes Source: https://docs.levelblue.com/api-reference/history/list-changes /documentation/api-reference/v3.yaml get /investigations/{investigationId}/history Returns the change history of an investiation. # Create an Investigation Source: https://docs.levelblue.com/api-reference/investigations/create-an-investigation /documentation/api-reference/v3.yaml post /investigations Creates a new investigation potentially with alarms and events information. # Delete an Investigation Source: https://docs.levelblue.com/api-reference/investigations/delete-an-investigation /documentation/api-reference/v3.yaml delete /investigations/{investigationId} Removes an investigation and all of the associated sub-resources. # List Investigations Source: https://docs.levelblue.com/api-reference/investigations/list-investigations /documentation/api-reference/v3.yaml get /investigations Returns the list of investigations. Pagination and querying available. # Modify an Investigation Source: https://docs.levelblue.com/api-reference/investigations/modify-an-investigation /documentation/api-reference/v3.yaml put /investigations/{investigationId} Modifies the properties of an investigation. # Obtain an Investigation Source: https://docs.levelblue.com/api-reference/investigations/obtain-an-investigation /documentation/api-reference/v3.yaml get /investigations/{investigationId} Returns an investiation. # Create a Note Source: https://docs.levelblue.com/api-reference/notes/create-a-note /documentation/api-reference/v3.yaml post /investigations/{investigationId}/notes Creates a note for an investigation. # Delete a Note Source: https://docs.levelblue.com/api-reference/notes/delete-a-note /documentation/api-reference/v3.yaml delete /investigations/{investigationId}/notes/{noteId} Removes a note from an investigation. # List Notes Source: https://docs.levelblue.com/api-reference/notes/list-notes /documentation/api-reference/v3.yaml get /investigations/{investigationId}/notes Returns a list of notes associated with an investigation. # Modify a Note Source: https://docs.levelblue.com/api-reference/notes/modify-a-note /documentation/api-reference/v3.yaml put /investigations/{investigationId}/notes/{noteId} Modifies a note. # Obtain a Note Source: https://docs.levelblue.com/api-reference/notes/obtain-a-note /documentation/api-reference/v3.yaml get /investigations/{investigationId}/notes/{noteId} Returns a note associated with an investigtion. # Get OAuth Token Source: https://docs.levelblue.com/api-reference/oauth/get-oauth-token /documentation/api-reference/v2.yaml post /oauth/token Authenticate your client to receive an OAuth Bearer token. This endpoint uses Basic Authentication with your client ID as the username and the client secret as the password. # How to Submit a Security Issue to LevelBlue Source: https://docs.levelblue.com/documentation/how-to-submit-a-security-issue AT\&T is always working to improve the security of our products. You, the LevelBlue community, aid our ability to deliver secure software for our customers by informing us of security issues — so thank you! Have you discovered a security vulnerability? Disclose it to us through the [AT\&T Bug Bounty Program](https://hackerone.com/att) managed by HackerOne. You can find detailed information of program guidelines, program exclusions, program terms and conditions, reporting process, and awarding process on this page. ## What Vulnerability Information Are We Looking For? When submitting an issue, please provide a technical description that allows us to assess exploitability and impact of the issue, and include the following where appropriate: * Provide steps and any additional information we may need to reproduce the issue. * If you are reporting cross-site scripting (XSS), your exploit should at least pop up an alert in the browser. It is much better if the XSS exploit shows the user's authentication cookie. * For a cross-site request forgery (CSRF), use a proper CSRF case when a third party causes the logged-in victim to perform an action. * For a SQL injection, we want to see the exploit extracting database data, not just producing an error message. * HTTP request / response captures or simply packet captures are also very useful to us. Please refrain from sending us links to non-LevelBlue websites, or issues in PDF / DOC / EXE files. Image files are OK. Make sure the bug is exploitable by someone other than the user ("self-XSS"). We are unable to respond to generic scanner reports. If you have had a security practitioner examine a generic scan report and they have isolated specific vulnerabilities that need to be addressed, we request that you report them individually. # LevelBlue Documentation Source: https://docs.levelblue.com/documentation/index
Welcome to LevelBlue Docs!

Learn how to get started with LevelBlue

Explore the docs

Get started with tools and guides

Cloud-based security monitoring platform that unifies threat detection, incident response, and compliance across all environments Unified security monitoring console for MSPs and enterprises to manage multiple USM deployments, enabling centralized threat detection across cloud and on-prem environments FedRAMP-authorized threat detection platform for government, based on USM, deployed on AWS GovCloud with Moderate ATO Network security platform that enables interaction with firewalls from multiple vendors in a consistent and intuitive manne
# Create Source: https://docs.levelblue.com/documentation/policy-manager/create The **Create** page allows users to request or perform any **Action** on an asset. ## Types of Actions The **Actions** displayed are dependent on the service(s) you have provisioned. You can navigate between the different **Services** at the top of the page as illustrated by the screenshot below. ### Firewall Below are the types of **Firewall** actions: * **Access Request (Automated)**: Add a rule or create new objects, groups of objects, services, and groups of services in the existing rulebase of automated firewall. * **Create or Modify Group (Automated)**: Create or modify a group. Policies may be affected when a group is created or modified. * **Decommission Rule (Automated)**: Disable or delete a rule in the existing rulebase of automated firewall. * **Edit Rule (Automated)**: Edit a rule in the existing rulebase of automated firewall. * **Manual Access Request**: A manual way to request to add a rule or create new objects, groups of objects, services, and groups of services in the existing rulebase of selected firewall(s). * **Manual URL Filtering**: Request a manual change to adjust a configuration on selected device for specific URL(s) allowing or denying access to the internet. * **NAT Request**: Request a change on the Network Address Translation configuration of selected device(s). * **Other**: General request. You may use this option in case automated or other manual requests from the catalog are not suitable for your request. * **Routing Configuration**: Request to change the routing configuration on selected device(s). * **URL Filtering (Automated)**: Manage the URLs that can be allowed or denied access to the Internet. * **Upgrade Software**: Request for a manual software update. * **User Access**: Request user access to specified device(s). ### DDoS Below are the types of **DDoS** actions: * **DDoS Change**: Open DDOS change ### Problem Below are the types of **Problem** actions: * **Report a Problem**: Report a problem with the asset ### Sensor Below are the types of **Sensor** actions: * **Sensor Change**: Open Sensor change *** ## Initiating Change Actions The **Create** page allows you to select or request an action to be implemented on specific assets. While the required information may differ depending on the selected action, the same high-level process is still followed. ### Initiating Firewall Action **To request a firewall action:** 1. On the **Create** page, select the **Firewall** tab and then select the action you want to request. 2. Search for and select the asset from the list. 3. On the **Access Request** section, enter or select the **Assets**, **Business Justification**, and **Implementation Time**. 4. Complete the rest of the sections based on the ticket type. Once done, click **Next**. 5. Wait until the **Configuration Checklist** is generated. 6. Once the checklist is generated, select any of the following actions to proceed: * **Accept** - continue with the automation * **Manual** - if the checklist fails, proceed to a manual ticket * **Cancel** - cancel the ticket ### Initiating DDoS Change **To request a DDoS change:** 1. On the **Create** page, select the **DDoS** tab and then **DDOS Change**. 2. Search for and select the asset from the list. 3. On the **DDOS Change** section, enter or select the **Assets**, **Business Justification**, and **Implementation Time**. 4. Click **Submit**. ### Reporting a Problem **To report a problem:** 1. On the **Create** page, select the **Problem** tab and then **Report a Problem**. 2. Search for and select the asset you want to report. 3. Enter the required information on the following sections: **Assets**, **Severity**, **Problem Abstract**, **Problem Description**, **Preferred Contact Method**, and **Contact Information**. You may also add any relevant **Access Instructions** or **Attachments** to the ticket. 4. Click **Submit**. ### Initiating Sensor Change **To request a sensor change:** 1. On the **Create** page, select the **Sensor** tab and then **Sensor Change**. 2. Search for and select the asset from the list. 3. On the **Sensor Change** section, enter or select the **Assets**, **Business Justification**, and **Implementation Time**. 4. Click **Submit**. # Dashboard Source: https://docs.levelblue.com/documentation/policy-manager/dashboard The **Dashboard** page shows a summary of what goes on in the selected environment. It consists of four sections: **Health**, **Changes**, **Quick tasks**, and **To-do**. * **Health**: The Health widget provides information about the Reachability of all assets and the number of open Sev 1 and Sev 2 Incidents. * **Reachability**: The Reachability widget measures how many assets are reachable and displays the value as a percentage of the whole. For example, if there are five devices and four are reachable, there is 80% Reachability. * **Incidents**: The Incidents widget shows the number of open Sev1 and Sev2 Incidents. * **Changes**: The Changes widget provides a summary for all **Open** and **Ready to Close** change tickets that are open across the company. Ready to Close changes are waiting for customer feedback in order to close. * **To-Do**: The To-Do widget shows all outstanding Change tasks for the active user. Unlike the Changes widget, the items listed in the To-Do list are user specific, so it will only display outstanding items assigned to you (as the user who is currently logged in). You can click on the listed To-Do’s and will automatically be redirected to the open item. * **Quick Tasks**: The Quick Tasks widget is on most pages of the platform and allows you to perform common tasks more easily. The tasks included in the Quick Tasks widget are **Automated Access Requests**, **Automated Decommission Rule**, and **Automated Edit Rule**. If you select any of these tasks, you will be redirected to the page to complete the request. # Manage Source: https://docs.levelblue.com/documentation/policy-manager/manage The **Manage** page enables you to view more information about a specific asset. APM Manage Overview ### Asset Selection To select which asset to see details about, click the **Display assets list** checkbox. A list appears on the left side of the table, which you can scroll through the list to find the asset you want, or you can also search in the **Search Asset** bar at the top of the panel. The dot next to the Asset name indicates if the device is online or not. When the dot is green, the asset supports automated features. ### Advanced Filtering If you need to expand the asset list to another Site or Service to see different assets, click **Advanced Filtering**. The Advanced Filtering dialog box opens, allowing you to select from all of the **Sites**, **Services**, and **Assets** in your environment. The following sub-topics are covered in this section: * [Asset Info](/documentation/policy-manager/manage/asset-info) * [Policies](/documentation/policy-manager/manage/policies) * [Objects](/documentation/policy-manager/manage/objects) * [Services](/documentation/policy-manager/manage/services) * [Interfaces](/documentation/policy-manager/manage/interfaces) * [Routes](/documentation/policy-manager/manage/routes) * [URL Filtering](/documentation/policy-manager/manage/url-filtering) * [Monitoring](/documentation/policy-manager/manage/monitoring) * [Geoblocking](/documentation/policy-manager/manage/geoblocking) # Asset Info Source: https://docs.levelblue.com/documentation/policy-manager/manage/asset-info To view more details about an asset, select the name of the specific **Asset** from the **Manage** page to view the **Asset Details** page. The **Info** tab is shown by default, which allows you to view the details and tickets associated with an asset. On the left side, you can see the details of the device including the **Device Type, Service, Model, Serial number**, and **Site name**. Next to the device details, there are additional health metrics about the device, including: **Operating System, Uptime, High availability, Availability, Firewall Traffic, IPv4, Active Sessions, CPU,** and **Recent Problems.** ### Setting an Alias You can set an alias for your assets for easier reference. **To set an alias for an asset:** 1. In the **Firewall Details** section, click the pencil icon below the **Alias** field. 2. Enter the **Hostname Alias**, and then click **Submit**. The Alis is now displayed next to the Asset name. ### Tickets In the **Tickets** table, all of the change tickets that have been opened for the selected asset are listed in a table format. There is a **search box** provided on the right that allows the user to enter a search. The ticket table is automatically filtered based on the input, which is matched to the text in any of the columns. For additional information about the ticket, the user can click on a specific ticket number. The view of the table can be changed using the options across the top: Tickets Table * **My tickets** – Filters the table to only display the tickets submitted the active user * **Show closed** – Includes all closed tickets in the table (The table defaults to only show open tickets.) * **Expand** – Shows additional details about the ticket # Assets Source: https://docs.levelblue.com/documentation/policy-manager/manage/assets The **Assets** page allows you to view all of the assets in the environment. You can filter the assets on the left-hand side by both **Site** and **Services**. You can also select one or multiple sites and services to filter the table. For more information on a specific asset, click on the **Asset Name** and you will be directed to the **Asset Info** tab on the **Manage** page. You can change what is displayed on the **Assets** table by filtering the fields, using pre-defined views, or modifying the columns. ### Filter Applying filters to the table further narrows down the asset list. **To filter the fields:** 1. Click **Filter**. Select Filter 2. Click **+Add a filter**. A list of fields is shown, including **ID**, **Name**, **Status**, **Site Name**, etc. Filter Add 3. Select the field to be added as a filter. Click **Clear** to remove the selected filters. ### Views Click **View** to select from different pre-defined views, including OS Upgrades. ### Columns **To add or remove columns:** 1. Click **Columns**. A dropdown list appears with a list of all available columns. Columns Columns Dropdown 2. Select the checkboxes of the columns you would like to add. The table changes automatically to reflect the modifications. ### Export You can export the current view of the Asset table in CSV format. The exported file will include everything that is currently displayed on the screen. * To change the columns on the table to be exported, use the **Columns** function exporting the table. * To change the number of assets on the table to be exported, change the number at the bottom of the table. # Early Access Features Source: https://docs.levelblue.com/documentation/policy-manager/manage/early-access Before new features are available for all users in the portal, these will be available to customers as **Early Access Features**. **To enable early access features:** 1. Click the **About** link at the bottom left corner of the Navigation Panel. About 2. On the **About** page > **Early Access** section, click the dropdown list and select the feature you want to enable. Early To disable an Early Access Feature, click **Back to Steady** version. Back # Geoblocking Source: https://docs.levelblue.com/documentation/policy-manager/manage/geoblocking The **APM Geoblocking** feature allows you to block traffic from many IP addresses that are currently known to belong to networks in other regions or countries. Firewall policy must have a **Geo Group** defined as source or as destination object. Geo group details can be seen in the **Geoblocking** tab by selecting an appropriate group. Once selected, the list and map will populate the countries/regions defined in the group. You can remove and add countries and regions on the list, and the map will reflect the updated selection. Once ready, you **Submit a change**. After submitting the change, you will be directed to the **Geoblocking Request** ticket page. Enter the required details, and review the **Request** section that lists all of the changes made on the previous screen. You can still add any country from the dropdown list and/or remove it by clicking the trash bin icon. # Interfaces Source: https://docs.levelblue.com/documentation/policy-manager/manage/interfaces The **Interfaces** tab shows a scrollable list of interfaces that are actively monitored. Interfaces that are administratively down are not displayed. Additional information on Interfaces can be found on the **Monitoring** tab. # Monitoring Source: https://docs.levelblue.com/documentation/policy-manager/manage/monitoring The **Monitoring** tab provides an overview of the status of an asset. ### Changing the Date Range You can select the timeframe from which the data is being displayed. The default time frame is **Current**. The larger the time range, the longer it will take for the data to be displayed. **To change the date range:** 1. Click the **Current** dropdown. The **Time Range** options are displayed. Date Range 2. Select the checkbox of the timeframe you prefer. You may also select the **Custom** checkbox to specify a specific date and time range. Custom Range Click the **blue calendar** icon to open the calendar widget and select a date. 3. Click **Apply**. ### Problems The **Problems** section shows a list of the total number of current problems detected by the solution monitoring tools. You can click the entry link to view more details about the problem, including the time it occurred, severity, details of the issue, and duration of the problem. The **Duration** time will only be updated when the browser window is refreshed. ### Performance The **Performance** section provides information about the performance of the device, including the availability, CPU, memory, number of active sessions, and total firewall traffic. You can click on any of the values to see graphs of the data. CPU utilization is an average of all CPU cores at a given time. ### Interfaces The **Interfaces** section provides details for the **Ingress** and **Egress** for all of the interfaces associated with the selected asset. To display a graph of the traffic, select the checkbox next to the designated interface. Interfaces # Objects Source: https://docs.levelblue.com/documentation/policy-manager/manage/objects ### Viewing Firewall Objects To view a **firewall object**, a firewall asset must be selected. Once this is done, you can click on the **Objects tab** of the **Manage** page, which provides the capability to view the **firewall objects** for the selected asset. The default view will display all the firewall objects sorted by **Name**. You can sort the table by a different field by clicking on column headers (**Name**/**Value**/**Type**). The slider on the right side allows you to select the fields you would like to view in the display of the firewall rules. To view more details about the object, select the object name and the information will pop up. ### Editing Groups A user can edit a **Group** by clicking on the box at the left of the entry to activate the **Edit Group** button for the selected object. **To edit a group:** 1. Select the checkbox of the group to be modified. 2. Click **Edit Group**. The **Create or Modify Group** form opens. The selected object must be a **Group**; otherwise, the **Edit Group** button will not be available. 3. Enter the required information: **Assets**, **Business Justification**, **Implementation Time**, **Internal Ticket Number** (optional), and **Additional Emails** (optional). Modify Group 4. Enter the **Name**, **Type**, and **Comments** (optional) on the **Request** section. 5. Select the applicable **Objects and Groups** from the **Available Objects and Groups** (left side). 6. Click the **>** icon to add your selections to the **Assigned Objects and Groups** section (right side). Click the **\<** icon to move objects or groups out of the **Assigned Objects and Groups** section. 7. Click **Submit**. ### Creating Groups or Objects You can create a new **Group** or **Object** from the **Objects** page. **To create a group or object:** 1. Click **+Create**. 2. Select from the drop-down menu: **New Group from the selection**, **New Group**, or **New Object**. Create Group To create a **New Group from selection**, one or more objects from the table must be selected. * If you select **New Group**, you will be directed to the **Create or Modify Group** ticket page. * If you select **New Object**, you will be directed to the **Access Request** ticket page. # Policies Source: https://docs.levelblue.com/documentation/policy-manager/manage/policies The **Policies** tab allows you to view and modify the firewall policies configured on the selected asset. By default, the initial view is a display of all the firewall rules ordered by sequence number and default set of columns is displayed for each vendor. The black lines are active rules while the greyed-out lines have been disabled. Users can display additional columns by selecting the Slider Button to the right of the search box. ### Viewing Previous Revisions **To view previous revisions:** 1. Select the dropdown beside **Revision**. Policies Revision All of the previous revisions are time-stamped and shown on a list. Policies List 2. Select any of the previous revisioni to display that version. 3. To revert to the current version, select **Current** from the list. ### Comparing Revisions You can compare different versions of policy on an asset. **To compare policy revisions:** 1. Click on the **Compare** toggle. Policies Compare 2. Select the first revision you would like to compare. Compare Manage **Revision2** will always default to the Single view that is displayed when the Compare toggle has been selected. The table will populate the differences. Manage Revisions 3. **(OPTIONAL)** To change Revision2, select the preferred Revision from the drop-down list. Revisions Change ### Adding New Firewall Rules You can add a rule in multiple ways: **Create New Rule**, **Create New Rule Before**, and **Create New Rule After**. **To create a new firewall rule:** 1. Click **+Create**. 2. Select from the drop-down menu: **New Rule**, **New Rule Before**, or **New Rule After**. To create a new rule before or after, an existing rule must be selected. Select Create 3. Complete the required fields on the top of the form: **Assets**, **Business Justification**, and **Implementation Time**. Access Request 4. Enter the Policy information at the bottom of the form: **Rule Location**, **From**, **To**, **Sources**, **Destinations**, **Services**, **Action**, and **Comments** (optional). Policy Info 5. Submit the form. ### Defining Objects and Groups You can define new objects and groups using the **Objects** tab on the **Access Request** page. This page allows for the addition of new objects and groups, as well as addition of objects to existing groups. Submitting this rule schedules an internal job to add the rule to the target firewall devices in a few minutes. It is advisable to check back to ensure the new object is shown under the Objects tab, confirming the rule is now activated on the firewall. **To define an object and group:** 1. Click **+Create**. 2. Select from the drop-down menu: **New Object** or **New Group**. New Group 3. Complete the required fields on the top of the form: **Assets**, **Business Justification**, and **Implementation Time**. Required Fields 4. Click **Create object** or **Create group**. Create Object 5. Enter the object or group information at the bottom of the form. 6. Click **Create**. Group Object 7. Submit the form. ### Editing or Decommissioning Rules To edit or decommission a rule, select the rule(s) to be edited by selecting the checkbox beside each entry on the **Manage** page, then select **Edit** or **Decommission**. This opens the page with the details for the existing rule. # Routes Source: https://docs.levelblue.com/documentation/policy-manager/manage/routes The **Routes** tab shows the routing table and allows for **Route Lookup**. The table shows the routing table for the selected asset. The routing table shows all types of routes, including local, static, and dynamic. It retains historical revisions; and whenever the routing table is changed, a revision is stored. To learn more about viewing past revision and comparing revisions, see [Manage - Policies](/documentation/policy-manager/manage/policies) section. ### Route Lookup You can search routes by IP via the Route Lookup feature. A subnet mask is not required. **To search via IP** 1. Click **Route Lookup**. 2. Enter the **IPv4 address**. Routes Lookup 3. Click **Submit**. Results are displayed. # Services Source: https://docs.levelblue.com/documentation/policy-manager/manage/services The **Services** tab allows a user to view all Services and Applications associated with the selected device. You can create new Services or Groups by clicking **+Create**. # Tickets Source: https://docs.levelblue.com/documentation/policy-manager/manage/tickets In the **Tickets** section, all of the change tickets that have historically been opened are listed in a table format. You can use the search field on the top right corner to search for tickets. The ticket table is automatically filtered based on the input, which is matched to the text in any of the columns. For additional information about the ticket, simply click on a specific ticket number. The view of the table can be changed using the options across the top: * **My tickets** – Filters the table to only display the tickets submitted the active user * **Show closed** – Includes all closed tickets in the table; the table defaults to show closed tickets only * **Expand** – Shows additional details about the ticket ### Ticket Details To view the details of a ticket, click the ticket number and you will be taken to the ticket details page. On the page, you can see the **Ticket Stage**, details of the submission, as well as the means to communicate back and forth with the LevelBlue team. ### Ticket Stage There are six stages for Automated Change Tickets: Initialized, Generate Config, Planned, Automation, Manual, Completed, and Cancelled * **Initialized**: This is the first stage after submission. This means the ticket has been successfully submitted and is awaiting to be picked up by someone on the LevelBlue team. * **General Config**: This stage is to confirm the device is accessible and the automated change can be applied. Customers are required to confirm the change on this stage. * **Planned**: This stage is used for Scheduled changes. The ticket remains in the Planned stage until the scheduled implementation time. * **Automation**: A ticket is in the Automation stages while the automation process is underway. * **Manual**: If the Automation fails, the ticket moves to Manual while it waits for manual implementation from the Operations team. * **Completed**: This is the last stage. It means the automation is complete, or the ticket has been closed by the Operations team. * **Cancelled**: This means the ticket has been cancelled by either the customer or the LevelBlue team. Details for the cancellation can be found in the Communication section of the ticket. # Dark Mode/Light Mode Source: https://docs.levelblue.com/documentation/policy-manager/manage/ui-modes You can choose how the UI is displayed, with options of either **Light Mode** or **Dark Mode**. Whatever option is chosen will be the default view for future sessions until changed. **To change UI modes:** 1. Select the **My Profile** icon at the top right corner of the page. My Profile 2. Select the toggle next to **Light Mode** or **Dark Mode** to switch to the other mode. Settings # URL Filtering Source: https://docs.levelblue.com/documentation/policy-manager/manage/url-filtering URL filtering allows you to configure how people can access webpages through its network. There are some variations in terms of the view based on the vendor. The sections below present more information on the vendors. ### Viewing URL Filters of Specific Assets Viewing URL filters associated with specific assets is vendor specific. **Fortinet**, **Palo Alto**, and **Checkpoint** filtering are covered separately below. ### Fortinet Filtering To view URL filters on a specific asset, go to **Manage** > **Policies** tab. The URL filters appear in the **Security Profile** column of the \*\*Policies \*\*table. When a filter exists, it is listed as **Web Filter** within the Security Profile column (as shown on the screenshot below). To view the details of the filter, click on the blue hyperlink next to Web Filter. You will then be redirected to the **URL Filtering** tab. The **URL** table shown below includes the **URL, Type**, and **Action** for each filter. The **Category** table is displayed below the URL table and is read-only. To edit a filter, click **Edit Filter** to display the **URL Filtering** form. See **Editing URL Filters** for details. ### Palo Alto Filtering To view URL filters on a specific asset, go to **Manage > Policies** tab. URL filters appear in the **Custom Filters** column of the **Policies** table. They are categorized into **Alert**, **Allow**, and **Block**. Clicking a link displays the URLs listed for the associated action. For example, clicking the block link displays a pop-up window displaying the list of blocked URLs. Click the **URL Filtering** tab to display all filtered URLs. URL filters may be edited from this screen by clicking the **Edit Filter** button. * If **Edit Filter** function is greyed out, select the appropriate **Device Group** from the dropdown. * If the **Edit Filter** function remains greyed out after selecting the appropriate **Device Group**, the filter may be shared. Shared filters cannot be edited from the portal. You need to create a request to have this edited manually. ### Checkpoint Filtering To view URL filters on a specific asset, go to **Manage > Policies** tab. URL filters are displayed in the **URL Filters** column in the **Policies** table when the **Application Layer** option is selected. Whether the filter blocks or allows traffic is defined by the **Action** of the rule. Clicking on the **URL Filter** name displays the filter details. To view and edit filters, click on the **URL Filtering** tab. Select a filter from the dropdown menu. ### Editing URL Filters To edit a filter, click **Edit Filter** to display the **URL Filtering** form. Enter the relevant details and select an implementation time to schedule the change. **To edit a filter:** 1. Click **Edit Filter**. You will be directed to the URL Filtering form. Edit Filter 2. Enter the required information: **Assets**, **Business Justification**, **Implementation Time**, **Request Details** (optional), **Additional Emails** (optional), and **Internal Ticket Number** (optional). Url Filter Form 3. Enter the required information in the **Request** section of the form. Request Form 4. Enter the **URL** to filter. Filter Url 5. Select the **Action** to implement, and then click **Add**. Steps Multiple URLs can be processed at once. Click the trash bin icon to delete the URL request. Deleted entries will appear with a strike through. However, if you want to undo the delete action, click the revert icon. Optional Request 6. Once done, click **Submit** to create a ticket to be automatically processed. # Navigation Panel Source: https://docs.levelblue.com/documentation/policy-manager/navigation On the left side of the page, there is a navigation panel with the following sections: Dashboard, Create, Manage, Tickets, Assets, and Reports. * **Dashboard** - This page provides a summary information about what goes on in the environment. It shows **Health**, **Changes**, a **To-Do** list, and **Quick tasks**. * **Create** - This page is where you can go for any **Requests**, including **Access Requests**, **URL Filtering**, and **Editing** or **Decommissioning a Rule**. * **Manage** - This page allows you to drill down into the details of a specific asset. * **Tickets** - This page lists all of the tickets for an organization. * **Assets** - This page displays all of the user’s assets. * **Reports** - This page allows you to generate and download monitoring data for your devices. #### Hiding the navigation panel You have the ability to condense the navigation panel to save space in your view. At the bottom of the left-hand navigation panel, there is a `<< Hide` button, which hides the titles of the pages, leaving only the icons. To display the page titles again, click the `>>` button at the bottom of the panel. APM Nav Pane ### Burger menu The burger menu on the top right-hand corner allows you to navigate to the **Fusion** portal. Fusion APM # Network Based Firewall Service (NBFW) Source: https://docs.levelblue.com/documentation/policy-manager/network [FSSO\_Software.zip](https://sdnportal.att.com/sddc/cybersecurity/documents/docuwiki/63f1a682-d4cc-4cdf-8aa5-72608c856c40/attachment/1fd97b8a-fec4-4a42-babd-633e69a96b2d) # Overview Source: https://docs.levelblue.com/documentation/policy-manager/overview Automated Policy Manager (APM) allows customers to perform common firewall operations using the self-service capabilities of the APM web portal. The APM web interface enables interaction with firewalls from multiple vendors in a consistent and intuitive manner. The result is a reduction in the time required to complete common operations, often down to just a few minutes. Each firewall change request is handled as a **Change Request** ticket, which you can manually execute or run automatically. For automated requests, if the automation engine cannot complete the requested operation, the ticket is retried several times and only then queued for manual handling by a Managed Security Services (MSS) operations expert. ## Features of this platform include: * **Secure Co-Management** - Ensures end users are authenticated and provided restricted access only to firewalls they are authorized to view or modify * **Firewall policy viewing capabilities** - A web interface that provides multiple ways to sort and view firewalls, along with their associated policies, objects and other attributes * **Firewall policy change capabilities** - Simple and powerful ways to modify policies (i.e., specifying a common policy change across multiple firewall models via a single request) * **Reduced Training requirements** - Users do not require training on specific vendor firewall technologies and commands. The APM platform normalizes the operating experience across vendors, resulting in a simplified user experience. * **Automated Change Control Workflows** - APM is tightly integrated with an automated workflow engine based on ServiceNow. This ensures requests are routed through the appropriate review and approval process prior to execution. This chapter discusses the following topics: * [Navigation Panel](/documentation/policy-manager/navigation) * [Dashboard](/documentation/policy-manager/dashboard) * [Create](/documentation/policy-manager/create) * [Manage](/documentation/policy-manager/manage) * [Tickets](/documentation/policy-manager/manage/tickets) * [Assets](/documentation/policy-manager/manage/assets) * [Reports](/documentation/policy-manager/reports) * [Dark Mode / Light Mode](/documentation/policy-manager/manage/ui-modes) * [Early Access Features](/documentation/policy-manager/manage/early-access) # Reports Source: https://docs.levelblue.com/documentation/policy-manager/reports You may download the Monitoring Data for your devices through the **Reports** page. Every time you generate a report, it is stored on the Reports page for future reference. ### Generating a Report **To generate a report:** 1. Click **Reports** from the left navigation panel. The **Reports** page opens. 2. Click **Generate**. Generate Reports 3. Select the **Time Range** for the report. You may choose as early as the **Last Hour** up to the **Last 30 days**. You may also choose a **Custom** time range. RPT Time Range 4. Click **Apply**. 5. Select the **Type** of report you want to generate. RPT Type 6. Select the **Assets** that you want to include in the report. RPT Assets The **Assets** lists only shows devices where data monitoring is available. 7. Click Generate. ### Downloading a Report **To download a report:** 1. Click **Reports** from the left navigation panel. The **Reports** page opens. 2. Select the checkboxes of the reports you want to download. RPT Select Rpt A maximum of 10 reports can be downloaded at a time. 3. Click **Download**. 4. Once done, open the downloaded zip folder. RPT Download RPT 5. Extract the zip files prior to opening them. RPT Extract Files The files will not open unless they have been extracted. 6. Select and open the report you need. # LevelBlue TDR for Gov Documentation Source: https://docs.levelblue.com/documentation/tdr-for-gov LevelBlue Threat Detection and Response for Government (LevelBlue TDR for Gov) is built on the Federal Risk and Authorization Management Program (FedRAMP)-authorized, industry-leading Unified Security Management (USM) platform. This combines multiple essential security capabilities and enables fast deployment and broad visibility across your whole network. LevelBlue TDR for Gov has achieved FedRAMP Moderate Authority to Operate (ATO) on Amazon Web Services (AWS) GovCloud. The following table lists the feature parity and divergence between USM Anywhere Premium and LevelBlue TDR for Gov. Unless specified, LevelBlue TDR for Gov adheres to USM Anywhere's documentation. **Comparison Between USM Anywhere Premium and LevelBlue TDR for Gov** | Product Capabilities | USM Anywhere Premium | LevelBlue TDR for Gov | | -------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | [Asset discovery and inventory](/documentation/usm-anywhere/user-guide/asset-management/asset-administration/assets-administration) | ✔️ | ✔️ | | [Vulnerability assessment](/documentation/usm-anywhere/user-guide/vulnerability-assessment/about-vuln-assess) (supports CVSS v2 and v3) | ✔️ | ✔️ | | Intrusion detection, [host IDS](/documentation/usm-anywhere/deployment-guide/admin/file-integrity-monitoring) | ✔️ | ✔️ | | Intrusion detection, [network IDS](/documentation/usm-anywhere/deployment-guide/portmirroring/portmirroring) | ✔️ | ✔️ | | Intrusion detection, [cloud IDS](/documentation/usm-anywhere/deployment-guide/aws/vpc-traffic-mirroring) | ✔️ | ✔️ | | [SIEM event correlation](/documentation/usm-anywhere/user-guide/events/events-management) | ✔️ | ✔️ | | [Incident response](/documentation/usm-anywhere/user-guide/investigations/about-investigations) | ✔️ | ✔️ | | [Endpoint detection and response](/documentation/usm-anywhere/agents/alienvault-agents) | ✔️ | ✔️ | | [Log management](/documentation/usm-anywhere/deployment-guide/setup/about-log-management) | ✔️ | ✔️ | | [Compliance reports](/documentation/usm-anywhere/user-guide/reports/compliance-templates) | ✔️ | ✔️ | | [Email alerts](/documentation/usm-anywhere/user-guide/rules-management/notification-rules) | ✔️ | ✔️ | | [Integrated ticketing and alerting](/documentation/usm-anywhere/alienapps-guide/salesforce/alienapp-salesforce) | ✔️ | ✔️ | | [Orchestration with security tools](/documentation/usm-anywhere/user-guide/rules-management/orchestration-rules) | ✔️ | ✔️ | | [Investigations](/documentation/usm-anywhere/user-guide/investigations/about-investigations) | ✔️ | ✔️ | | [Automated incident response and forensics](/documentation/usm-anywhere/alienapps-guide/forensics-response/blueapp-forensics-response) | ✔️ | ✔️ | | [Dark web monitoring](/documentation/usm-anywhere/alienapps-guide/dark-web/alienapp-spycloud) | ✔️ | ✔️ | | [Advanced BlueApps](/documentation/usm-anywhere/alienapps-guide/about-blueapps) | ✔️ | ✔️ | | Advanced Security Notifications (through third party software services) | ✔️ | ✔️ | | Support for higher data volumes | ✔️ | ✔️ | | Support PCI log storage requirements | ✔️ | ✔️ | | Threat Intelligence powered by LevelBlue Labs™ | ✔️ | ✔️ | | [Sensor deployment](/documentation/usm-anywhere/deployment-guide/about-usm-anywhere-deployment) | ✔️ | ✔️ | | On premises, [Hyper-V](/documentation/usm-anywhere/deployment-guide/hyperv/about-hyperv) | ✔️ | ✔️ | | On premises, [VMWare](/documentation/usm-anywhere/deployment-guide/vmware/about-vmware-sensor-deployment) | ✔️ | ✔️ | | Commercial Cloud Environments, [Amazon Web Services (AWS)](/documentation/usm-anywhere/deployment-guide/aws/about-usm-aws-sensor-deployment) | ✔️ | ✔️ | | Commercial Cloud Environments, [Microsoft Azure](/documentation/usm-anywhere/deployment-guide/azure/about-azure) | ✔️ | ✔️ | | Commercial Cloud Environments, [Google Cloud Platform (GCP)](/documentation/usm-anywhere/deployment-guide/gcp/about-gcp-sensor-deployment) | ✔️ | ✔️ | | Government Cloud Environments, [AWS GovCloud](/documentation/usm-anywhere/deployment-guide/aws/about-usm-aws-sensor-deployment) | ❌ | ✔️ | | Government Cloud Environments, [Microsoft Azure Government](/documentation/usm-anywhere/deployment-guide/azure/about-azure) | ❌ | ✔️ | | Government Cloud Environments, [GCP](/documentation/usm-anywhere/deployment-guide/gcp/about-gcp-sensor-deployment) | ❌ | ✔️ | | [AWS Cloud Connector](/documentation/usm-anywhere/deployment-guide/cloud-connector/aws/about-aws-cloud-connector) | ✔️ | ✔️ | | Reporting | [Scheduled reports](/documentation/usm-anywhere/user-guide/reports/scheduled-reports) | [Standard reports](/documentation/resources/pdf/tdr-for-gov-reports.pdf) | | Access URL | \.alienvault.cloud | \.gov.alienvault.us | | Geo-IP resolution | api.geoip-enrichment.\.prod.alienvault.cloud/geo-ip/sensor | api.geoip-enrichment.us-gov-west-1.prod-gov.gov.alienvault.us/geo-ip/sensor | | [Storage](/documentation/usm-anywhere/deployment-guide/admin/usm-anywhere-data-security), hot (searchable) storage | 15, 30, 90, or 180 days | 90 or 180 days | | [Storage](/documentation/usm-anywhere/deployment-guide/admin/usm-anywhere-data-security), cold storage | Unlimited | Unlimited | | [Storage](/documentation/usm-anywhere/deployment-guide/admin/usm-anywhere-data-security), data retention | Service term | Service term | | Customer support hours | Monday-Friday, 7AM-5PM Pacific | Monday-Friday, 8AM-6PM Eastern

(Support personnel are US citizens based in contiguous United States.) | | Platform monitoring | 24/7 | 24/7 (US citizens / US soil) | ## FAQ The license is only available on the USM Anywhere Premium tier due to federal guidance on 90-day data retention. No. At this time, LevelBlue TDR for Gov runs in Amazon GovCloud US-West only. FedRAMP is mandatory for federal agency cloud deployments and service models at the low, moderate, and high-risk impact levels. LevelBlue TDR for Gov is authorized as FedRAMP Moderate. LevelBlue TDR for Gov is the FedRAMP Moderate authorized version of USM Anywhere operating in AWS GovCloud. LevelBlue does not have a managed LevelBlue TDR for Gov offering at this time. There are no technical limitations, but if any of the data monitored in LevelBlue TDR for Gov requires Federal Information Security Management Act (FISMA) protection (almost all of it does), the data will need to be kept in AWS GovCloud and will require a AWS GovCloud hosted USM Central (not available today). LevelBlue is currently planning to develop an AWS GovCloud-hosted USM Central. Yes. Three failed sign-in attempts are allowed before the user account is locked. The lockout time is 30 minutes. # USM Anywhere™ Documentation Source: https://docs.levelblue.com/documentation/usm-anywhere USM Anywhere is a software as a service (SaaS) security monitoring solution that centralizes threat detection, incident response, and compliance management across your on-premises, cloud, or hybrid environments. Data collection, security analysis, and threat detection are centralized in the LevelBlue Secure Cloud and provide you with a single view into all of your critical infrastructure. The USM Anywhere documentation consists of the following topics: Also check the Success Center for [USM Anywhere Release Notes](https://success.alienvault.com/s/topic/0TO0Z000000oRSNWA2/anywhere-product-announcements). You can follow the page and elect to receive an email notification on every post, if you like. # LevelBlue Agent and Asset Associations Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/agent-asset-associations If you use a single asset installation script, the USM Anywhere universally unique identifier (UUID) for the selected asset is incorporated into that script. During the installation process, the deployed LevelBlue Agent registers with your USM Anywhere instance, makes the asset association, and updates the operating system (OS) name and network interface information on the asset. If you use a multiple asset installation script to execute bulk deployment across multiple host systems, the resulting installation will create a random UUID for the agent installation (see [LevelBlue Agent IDs](alienvault-agent-ids) for more information on UUIDs). For Linux hosts, USM Anywhere attempts to associate the agent with an existing asset based on Amazon Elastic Compute Cloud (EC2) instance metadata gathered from the endpoint. Before installing the agent on a Linux host, LevelBlue recommends that you perform an asset scan. This way, USM Anywhere will have identified the asset and can automatically associate the asset with the agent. **Important:** For Linux agents not running on EC2 instances, or any Microsoft Windows or Apple macOS agents, the agent must be associated to an existing or new asset through the Associate Agents With Assets page before you use the multiple asset installation script. After successfully deploying the agent on a host, the agent sends heartbeat events every 10 minutes until an asset is associated. These heartbeat events include basic information about the host system, including network interfaces and IP address as well as the asset ID if one is available. **Note:** The heartbeat events are important for monitoring LevelBlue Agent connectivity. It is important that you do not create any filtering rules to remove these notifications. If you don't want to see heartbeat events, LevelBlue recommends that you create a suppression rule instead. **Important:** An agent is considered offline if it has not reported at least one heartbeat in the last 12 hours. You cannot enable queries and log collection for the host system until a deployed agent has an associated asset in USM Anywhere. If an agent has not received an association automatically, you must make one manually. The Agents page (Data Sources > Agents) displays an alert when there are one or more unassociated assets, and provides tools designed to help you associate these agents with assets. It provides a list of suggested assets for selection and an easy way to create a new asset using the information provided by the agent. When you see this alert, click **Associate Agents with Assets** to open the Associate Agents With Assets page and complete the association. ## Associate or Unassociate the LevelBlue Agent with an Existing Asset To associate an agent with an existing asset, you can allow USM Anywhere to suggest a matching asset. If the suggested asset is incorrect, manually search and select the correct existing asset to associate it with the agent. **Important:** There is currently no way to remove the association between an LevelBlue Agent and an asset. If you need to change an association, you must uninstall the agent on the host system, redeploy the agent, and then make the new association as needed. **To make an association to an existing asset** 1. In the row for the unassociated agent, click **Associate Agent with Asset**. The dialog box displays a list of one or more suggested asset matches if USM Anywhere is able to locate potential matches in the asset library. 2. Select an asset for the agent: * If one of the suggested assets is correct, select the asset. * If the correct asset is not displayed or there are no suggested assets, enter part of the name or IP address of the asset in the Search field to display matching items and select the asset you want. * You can also click **Browse Assets** to open the Select Asset dialog box and browse the asset list to make your selection. If you are unable to locate the correct asset and determine that it does not currently exist in the asset inventory, click **Create a New Asset** to generate a new asset for the agent. 3. Click **Save**. A confirmation dialog box opens. 4. If you want to view the Asset Details page for the associated asset, click **View Asset**. Otherwise, click **Cancel** to close the dialog box and return to the Associate Agents with Assets page. **To remove the link between an asset and an agent** 1. Go to **Data Sources > Agents**. 2. Click **Unassociate Assets**. The link between the asset and the agent is removed. **Note:** When an asset is deleted, all of its associated LevelBlue Agents automatically become unassociated. ## Create New Assets for the Association You can automatically create an asset for one or more selected LevelBlue Agents if an asset for that agent does not already exist in the asset inventory. When USM Anywhere creates a new asset for the agent, it uses the hostname value for the asset name. After creation, you can modify various asset details as needed. See [Editing Assets](../user-guide/asset-management/asset-administration/editing-assets) for more information. **To create new assets for unassigned agents** 1. Select the checkbox in the row for each agent where an asset does not already exist in the asset inventory. Select the checkbox at the top if you want to create new assets for all of the listed agents. 2. At the upper right of the page, click **Create New Assets**. A confirmation dialog box opens. 3. Close the dialog box to return to the Associate Agents with Assets page. # LevelBlue Agent Configuration Profiles Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/agent-configuration-profiles USM Anywhere includes out-of-the-box LevelBlue Agent configuration profiles to manage the queries that it runs for an asset associated with a deployed [agent](alienvault-agents). For each configuration profile, you can view the list of queries, a description of the collected logs, and the query frequency. Depending on your needs, you can change the default configuration profile so that you collect the log data and generate the events for the newly deployed agents. USM Anywhere provides two configuration profiles for each of the agent deployment types: optimized and full. There are both preferable and less-than-preferable data security and data consumption reasons for choosing either configuration profile. Use the following information to help you determine which configuration profile works best for your setup. * **Optimized**: The optimized profile reduces data consumption by filtering certain events that are not correlated with alarms. * Does not collect syslog events. * Collects new process events and correlates for threat detection purposes, but stores them only when they are associated with an alarm. * Collects outbound socket events and correlates for threat detection purposes, but stores them only when they are associated with an alarm. **Note:** The optimized configuration profile monitors files in a specific set of locations. Because the locations of the monitored files are limited, the optimized profile cannot guarantee that the LevelBlue Agent is tracking all user interaction with secured files. This means that the optimized agent profile on its own doesn’t satisfy PCI DSS Requirement 10. * **Full**: The full (verbose) profile collects and stores all Linux log events, including syslog events, new process events, and outbound socket events. Using this profile could have a significant impact on your data consumption. See [Subscription Management](../user-guide/subscription-management/my-subscription) for more information about how USM Anywhere manages data consumption and storage. * **Optimized**: The optimized profile reduces data consumption by modifying the Windows Events query to retrieve only the event types that impact threat detection. * Collects Sysmon Windows event logs and correlates for threat detection purposes, but stores them only when they are associated with an alarm. For a list of the log collection paths monitored by this profile, go to **Data Sources > Agents > Configuration Profiles**, and click the **Optimized** profile for Windows, and then click the **Log Collection** tab to display the full list of paths. **Note:** The optimized configuration profile monitors files in a specific set of locations. Because the locations of the monitored files are limited, the optimized profile cannot guarantee that the LevelBlue Agent is tracking all user interaction with secured files. This means that the optimized agent profile on its own doesn’t satisfy PCI DSS Requirement 10. * **Full**: The full (verbose) profile collects and stores most Windows event types, ignoring a few events that provide little value as determined by the LevelBlue Labs™ team. For a list of the log collection paths monitored by this profile, go to **Data Sources > Agents > Configuration Profiles**, and click the **Full** profile for Windows, and then click the **Log Collection** tab to display the full list of paths. Using this profile could have a significant impact on your data consumption. See [Subscription Management](../user-guide/subscription-management/my-subscription) for more information about how USM Anywhere manages data consumption and storage. * **Optimized**: The optimized profile reduces data consumption by filtering certain events that are not correlated with alarms. **Note:** The optimized configuration profile monitors files in a specific set of locations. Because the locations of the monitored files are limited, the optimized profile cannot guarantee that the LevelBlue Agent is tracking all user interaction with secured files. This means that the optimized agent profile on its own doesn’t satisfy PCI DSS Requirement 10. * **Full**: The profile collects and stores all macOS events. Using this profile could have a significant impact on your data consumption. See [Subscription Management](../user-guide/subscription-management/my-subscription) for more information about how USM Anywhere manages data consumption and storage. In the Configuration Profiles view, you can click the individual profile name to display the queries executed by the agent and their frequencies. If you are looking for a specific type of log, enter text in the Search field, and then click the icon to filter the query list. **Note:** An agent event named "Outbound Connections" indicates that the agent found an open socket with an external IP address. LevelBlue recommends that you check the firewall logs to find matching events that can help clarify the communication process. If you want to see the specific file paths included in the profile's file integrity monitoring (FIM), click the **File Integrity** tab to display these paths by category. **Note:** Currently, the Windows FIM paths are as follows: `C:\Windows\System32\drivers\etc\hosts` `C:\autoexec.bat` `C:\config.sys` `C:\boot.ini` More Windows FIM paths will be added in future updates. **To display the agent configuration profiles** 1. Go to **Data Sources > Agents**. 2. Click **Configuration Profiles**. 3. Review and select the configuration profile you want to use by default. **Important:** The Experimental Profiles are temporary and internal. Do not use them unless you have instructions from the LevelBlue Technical Support department. ## Assign LevelBlue Agent Configuration Profiles to Assets You can assign a specific LevelBlue Agent configuration profile to an asset from the assets list page or asset details page. **To assign an agent profile using the actions list** 1. Go to **Environment > Assets**. 2. Select the asset, and then click **Actions > Assign Agent Profile**. 3. Select the agent profile you want to assign to the selected asset. USM Anywhere displays an informative message if assets exist but do not have agents deployed. 4. Click **Save**. **To assign an agent profile from the Asset Details page** 1. Go to **Environment > Assets**. 2. Locate the asset and click the icon next to name of the asset you want to assign the specific agent configuration profile, and then select **Full Details**. 3. Click **Agent**. 4. Click the Configuration Profile drop-down menu, and then select the profile you want to assign. **To assign an agent profile from the Configure Asset dialog box** 1. Go to **Environment > Assets**. 2. Locate the asset, click the icon next to the name of the asset you want to assign the specific agent configuration profile, and then select Configure Asset. **Important:** The Agent Profile field displays if the agent is connected and the user has the role of Manager. 3. Choose the agent profile you want to assign to the selected asset. USM Anywhere displays an informative message if assets exist but do not have agents deployed. 4. Click **Save**. ## Assign LevelBlue Agent Configuration Profiles to Asset Groups **To assign a LevelBlue Agent configuration profile to an asset group** 1. Go to **Environment > Asset Groups**. 2. Next to the asset group that you want to assign the profile, click the icon , and then select **Full Details**. 3. Select **Actions > Assign Agent Profile**. 4. Choose the agent profile you want to assign to the selected asset group. 5. Click **Save**. # LevelBlue Agent Deployment Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/agent-deployment To install the LevelBlue Agent on your hosts, generate an installation script in USM Anywhere that is specific to your USM Anywhere environment. When you run the installation script on the host system, the installed agent automatically registers with your USM Anywhere instance and configures the system to automatically collect data from the endpoint for threat detection. LevelBlue recommends that the host system has a minimum of 4 GB memory and 2 CPU cores for the agent. See [Microsoft Windows](alienvault-agents-install-windows), [Linux](alienvault-agents-install-linux), or [Apple macOS](alienvault-agents-install-osx) installation for operating system (OS)-specific requirements. The LevelBlue Agent uses osquery. Other endpoint security products may use osquery for similar tasks, perhaps with different paths or file locations. In theory, osquery running under a different process or service name should present no issues, but LevelBlue doesn't support installing a second agent that uses osquery. Additionally, it may be necessary to allowlist the service or process that the LevelBlue Agent uses in other endpoint security products so that the LevelBlue Agent can operate normally. The following table lists the osquery service and process used by the LevelBlue Agent and the [LevelBlue Agent script](agent-script). **osquery Service and Process Used by the LevelBlue Agent** | USM Anywhere Component | Platform | osquery Service | osquery Process | | ---------------------- | -------- | --------------- | --------------- | | LevelBlue Agent | Linux | osqueryd | osqueryd | | | macOS | osqueryd | osqueryd | | | Windows | osqueryd | osqueryd.exe | | LevelBlue Agent Script | Linux | N/A | osqueryi | | | macOS | N/A | osqueryi | | | Windows | N/A | osqueryi.exe | ## Agent Deployment Details The Agents page (Data Sources > Agents) provides an overview of your deployed LevelBlue Agents. Click the displayed numbers to view the agents in the Assets page (Environment > Assets). If there are unassociated agents, this page displays an alert to help you resolve them. See [LevelBlue Agent and Asset Associations](agent-asset-associations) for more information. # LevelBlue Agent Events and Queries Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/agent-query **Edition:** This feature is available in the Standard and Premium editions of USM Anywhere. USM Anywhere enables you to use the LevelBlue Agent data source to filter the LevelBlue Agent-related events. These data sources are related to the agent: * **LevelBlue Agent:** This data source parses events from the agent except for Microsoft Windows events. * **LevelBlue Agent - Windows EventLog:** This data source parses Windows events sent through the agent. **To search events using the filter related to the agent** 1. Go to **Activity > Events**. 2. Locate the Data Source section. 3. Click an event and the result of your search displays. ## LevelBlue Agent Queries USM Anywhere enables you to run a user-initiated LevelBlue Agent query based on the events sent by connected agents. There are several ad-hoc queries, which are in your environment by default. These queries, listed below, generate events that can be used for a forensic investigation, so you can focus on fast response and remediation. 1. Go to **Data Sources > Agents**. 2. Click **Run Agent Query**. You can select the operating system (OS): * All * Windows * Linux * macOS Select the asset in which you want to run the agent query. You can enter the asset name or browse assets. 3. Select a query in the Action field. 4. Click **Run**. **Note:** The queries generate events when you run them. They do not generate events continuously; you must run the query again if you want to generate new events. 1. Go to **Activity > Alarms**. 2. Click the alarm to display its details. 3. Select **Select Action > Agent Query**. 4. Select an action. 5. Click **Run**. A dialog box opens confirming the action has been initiated. 6. Click **OK**. Or click **Create rule for similar events** if you want to create a new rule. See [Response Action Rules from the Orchestration Rules Page](../user-guide/rules-management/response-action-rule) for more details. When the query is complete, the results are visible in events. You can also click the Agent tab in the details of the asset to see the Query History. You can see the name of the query, the date on which the query was run, the status (Query **In Progress**, **Processing Events**, and **Completed**), and, once the query is complete, there is the **View Results** link. This link goes to the filtered events. **Note:** The queries generate events when you run them. They do not generate events continuously; you must run the query again if you want to generate new events. 1. Go to **Activity > Events**. 2. Click the event to display its details. 3. Select **Select Action > Agent Query**. 4. Select an action. 5. Click **Run**. A dialog box opens confirming the action has been initiated. 6. Click **OK**. Or click **Create rule for similar events** if you want to create a new rule. See [Response Action Rules from the Orchestration Rules Page](../user-guide/rules-management/response-action-rule) for more details. When the query is complete, the results are visible in events. You can also click the Agent tab in the details of the asset to see the Query History. You can see the name of the query, the date on which the query was run, the status (Query In Progress, Processing Events, and Completed), and, once the query is complete, there is the View Results link. This link goes to the filtered events. **Note:** The queries generate events when you run them. They do not generate events continuously; you must run the query again if you want to generate new events. 1. Go to Environment > Assets. 2. Search the asset, click the blue chevron icon () located next to the asset name on which you want to run the agent query, and select Full Details. 3. Select **Actions > Agent Query**. 4. Select the query you want to run. 5. Click **Run**. A message displays at the top of the page to inform you the query is in progress. When the query is complete, the results are visible in events. You can also click the Agent tab in the details of the asset to see the Query History. You can see the name of the query, the date on which the query was run, the status (**Query In Progress**, **Processing Events**, and **Completed**), and, once the query is complete, there is the **View Results** link. This link goes to the filtered events. 1. Go to **Settings > Rules > Orchestration Rules**. 2. Select **Create Orchestration Rule > Create Response Action Rules**. 3. Enter a name for the rule. 4. Select **Agent Query** as the Action Type. 5. Select a query in the Action field. 6. Click **Add Condition** and select the property values you want to include in the rule to create a matching condition. **Note:** If the field is related to the name of a country, you should use the country code defined by the [ISO 3166](https://www.iso.org/iso-3166-country-codes.html). **Note:** The Sources or Destinations field needs to match the universally unique identifier (UUID) of the event or alarm. You can use the Source Name or Destination Name field instead. 7. (Optional) Click **Add Group** to group your conditions. **Note:** See [Operators in the Orchestration Rules](../user-guide/rules-management/orchestration-rules-operators) for more information. 8. In the **Occurrences** text box, enter the number of event occurrences that you want to produce a match on the conditional expression to trigger the rule. You can enter the number of occurrences or use the arrows to scroll the value up or down. You can enter a number between 1 and 100. 9. In the **Length** text box, specify the timespan that you want to use to identify a match for multiple occurrences. Enter the number in the text box, and then use the drop-down menu to select a value of seconds, minutes, or hours. This duration identifies the amount of time that transpires from the beginning to the end of the occurrence. If the number of occurrences is not met within this period, the rule is not a match. **Note:** Your defined length and occurrences function together to specify the number of occurrences within a time period that will produce a match for the rule. For example, you can define a rule to trigger an alarm for an unauthorized access attempt when a failed SSH login occurs three times within a five-minute window. 10. Click **Save**. The created rule will display in the list of rules. You can also click the Agent tab in the details of the asset to see the Query History. You can see the name of the query, the date on which the query was run, the status (**Query In Progress**, **Processing Events**, and **Completed**), and, once the query is complete, there is the **View Results** link. This link goes to the filtered events. **Note:** Regardless of agent status, an agent query may fail if connectivity to the agent was interrupted since the last heartbeat was received. The full list of queries are available in the following table. **Available LevelBlue Agent Queries** | Query Name | Platform | Description | | --------------------------------------------------------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Get Docker container running processes | Linux, macOS | Get the list of processes running in each Docker container. | | Get Docker containers details | Linux, macOS | Get a list of details for each Docker container. | | Get Docker containers open ports | Linux, macOS | Get a list with open ports and network information for each Docker container. | | Get file information | Linux, macOS, and Windows | Get information from the file specified in the first parameter. You must include the file path of the file. | | Get files downloaded in the system | macOS | Generate a list of all files downloaded in the system. | | Get IE typed URLs | Windows | Get the list of Microsoft Internet Explorer (IE)'s entered URLs. | | Get firewall configuration | Windows | Get a list of firewall configurations for different profiles and rules. | | Get installed packages history | macOS | Get the list of the latest installed packages in the system. | | Get logged-in users | Linux, macOS, and Windows | Get the list of currently logged-in users. | | Get listening processes | Linux, macOS, and Windows | Get the list of the processes with listening sockets. | | Get network connections | Linux, macOS, and Windows | Get the list of the current network connections. | | Get network connection information | Linux | Get information from a network connection based on the remote address (first parameter) and the remote port (second parameter). You must include the port and the IP address. | | Get network shares | Windows | Get the list of network-shared resources from the system. | | Get persistence registry keys | Windows | Get registry key values commonly used for persistence by attackers. | | Get recent files | Windows | Get the list of recent files. | | Get recent items | macOS | Get the list of recently opened files. | | Get running processes | Linux, macOS, and Windows | Get the list of running processes. | | Get running services | Windows | Get the list of running services. | | Get SSH authorized keys | Linux, macOS | Get the list of SSH-authorized keys allowed in the system. | | Get users launched services | macOS | Get the list of LaunchAgents and LaunchDaemons services installed in the system. | | Get Wi-Fi connection status | macOS | Get information from the current Wi-Fi connection. | | Get Wi-Fi preferred connections | macOS | Get information from the preferred Wi-Fi connections. | | Hunt for potential library injection - .so deleted from disk | Linux | Hunt for the potential library injection of a memory map with a deleted shared object on disk and rwxp memory. | | Hunt for potential library injection - no .so on disk and rwxp memory | Linux | Hunt for the potential library injection of a memory map with no shared object on disk and rwxp memory. | | Hunt for potential library injection - no common .so isolation | Linux | Hunt for the potential library injection of a shared library loaded from an uncommon location. | | Hunt for running processes with no binary on disk | Linux, macOS, and Windows | Hunt for running processes that do not have a matching binary on disk. | | Hunt for traffic to remote IP | Linux, macOS, and Windows | Hunt for non-web traffic to remote IP addresses not using port 0, 80, or 443. | # The LevelBlue Agent Script and Agent Updates Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/agent-script The LevelBlue Agent script enables you to run several commands for the installed agent. Each operating system (OS) has its own script, but the commands function the same across all systems. To use the command script, locate and run the file listed in the following table and follow any additional instructions that are noted. **Note:** The LevelBlue Agent is not configured to auto-update on its own. See [LevelBlue Agent Auto-Update](agent-script) below for details on how to enable the auto-update feature. **Location and Notes for the LevelBlue Agent Script** | System | Script | Location | Notes | | ----------------- | -------------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Microsoft Windows | alienvault-agent.ps1 | C:\Program Files\osquery | This is not part of the default Microsoft Windows path, so you must either use cd commands to point to the path, or input the path directly to run the script. | | Linux | alienvault-agent.sh | /usr/bin | Opened from the command line. | | Apple macOS | alienvault-agent.sh | /usr/local/bin | Opened in Terminal. | ## LevelBlue Agent Commands The following table contains the complete list of commands for the LevelBlue Agent script. The agent configuration, which includes information such as osquery data point checks and File integrity monitoring (FIM) paths, is checked and updated independently. **Commands Available for the LevelBlue Agent Script** | Command | Explanation | | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | start | Start the agent service. | | stop | Stop the agent service. | | restart | Restart the agent service. | | update | Update the agent version. | | enable-auto-update \[time] | Enable auto-update to check daily for new version.

Time can optionally be designated for the check (24-hour format HH:MM).

If no time is supplied, the daily check will occur between 09:00 and 17:00. | | disable-auto-update | Disable agent auto-update. | | force-update | Reinstall the agent service with the newest version.
(This reinstalls the agent even if you are running the most recent version.) | | uninstall | Uninstall the agent. | | version | Print the agent version number. | | help | Print help. | | config | Connect to the agent API server to print or download your agent configuration. | | osqueryi | Start an interactive osqueryi shell within your agent's configuration.

(Typically used for prototyping and troubleshooting queries against your current configuration.) | | report | Print a report containing pertinent information regarding agent information, including whether the auto-update feature is active.

(Contains version, platform information, host identification, and other information. This command is most useful for relaying information to LevelBlue Technical Support.) | ## LevelBlue Agent Auto-Update The LevelBlue Agent has an auto-update feature, but it's disabled by default. You can enable auto-update and specify a time to check for updates, then the agent will update automatically provided that your system is online at the time the update is scheduled and there are no local configurations preventing the scheduled task from being enacted. **Note:** The auto-update feature only exists in agent version 20.07.0003.0301 and later. If you are on an earlier version of the agent, you need to manually update the agent to attain the auto-update feature. The following procedure provides the steps for enabling the agent's auto-update function for each operating system (OS). You can use the agent script's report command to verify that the auto-update function is active. 1. Run the following command from a bash shell: `alienvault-agent.sh enable-auto-update HH:MM` Entering the time (HH:MM) is optional and, if not entered, the system will check for an update between 09:00 and 17:00. 2. Verify that osquery is running in your Linux terminal. **To enable agent auto-updates on Windows** 1. Run the following command from PowerShell as an admin: `C:\’Program Files’\osquery\alienvault-agent.ps1 enable-auto-update HH:MM` Entering the time (HH:MM) is optional and, if not entered, the system will check for an update between 09:00 and 17:00. 2. Verify that osquery is running in the Windows Task Manager. **To enable agent auto-updates on macOS** 1. Run the following command from a bash shell: `alienvault-agent.sh enable-auto-update HH:MM` Entering the time (HH:MM) is optional and, if not entered, the system will check for an update between 09:00 and 17:00. 2. Verify that osquery is running in the macOS Activity Monitor. When the LevelBlue Agent is updated, the installation process detects the presence of an [existing `osquery.flags` file](alienvault-agent-ids) and uses its `--specified_identifier` flag for identification, thus maintaining the continuity. # LevelBlue Agents Memory Consumption and the osquery Watchdog Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/agents-memory The LevelBlue Agent is configured to have two osquery processes running: an initial osquery process that functions as a watchdog, and the child worker process that creates the scheduled queries. The initial watchdog process manages the child worker and terminates any processes that exceed the memory limitations configured in the watchdog settings. ## Watchdog Overview The max threshold settings for the watchdog resources are: * CPU: Above 25% usage for over 9 consecutive seconds. * Memory: When 350MB is reached (LevelBlue Agent default setting). The watchdog profiles the memory footprint at startup and subtracts that from the monitored value. It only restarts the worker if that difference exceeds the watchdog level set at that time. So, if a watchdog level is set to 350MB and the agent starts up with an initial worker process footprint of 30MB, the watchdog limit will be triggered at 380MB (350MB limit + 30MB initial memory footprint = 380MB threshold limit). ### Watchdog Threshold Limits and Errors Once the watchdog limit is reached, [the osquery watchdog respawns the child worker process](https://osquery.readthedocs.io/en/stable/deployment/debugging/#scheduled-query-failures-and-the-watchdog). After osquery is restarted, the previously active queries are referenced by osquery to see which ones did not finish normally. It is possible that one or more of these queries caused the watchdog limit to be exceeded, therefore the unfinished queries are denylisted from the scheduler for 24 hours. If the osquery processes exceed their allocated resources, there is the possibility that the watchdog may respawn the process without giving any error message. A good indicator that this has happened can be found by looking at the logs subdirectory and at the timestamps of the files. If there is a high number of files with timestamps that are close together, it could be that the watchdog has been killing processes due to resource allocation limits. Here is an example: ### Scheduled Query Failure Messages The watchdog enforces limits on the worker process to protect systems from CPU-expensive and memory-intensive queries. If the watchdog observes limit violations, it will display an error similar to the following: `Scheduled query may have failed: <<...>>` This line is created when a child worker starts and finds what osquery calls a "dirty bit" toggled for the currently-executing query. If a child worker process is stopped abruptly and a query does not finish, a similar line may display. Lines that indicate the watchdog exceeded one of its limits include the following: `osqueryd worker (1234) system performance limits exceeded` `osqueryd worker (5678) memory limits exceeded: 442494` The process identifier (PID) of the offending child worker is included in parenthesis. If the child worker finds itself in a reoccurring error state, or if the watchdog continues to stop the worker, additional lines like the following are created: `osqueryd worker respawning too quickly: 1 times` The watchdog implements an exponential backoff when respawning child workers, and the offending query is denylisted from running for 24 hours. The osquery watchdog is only used for the worker process. It is enabled by default and can be disabled with a control flag. See [the official osquery documentation on query failures with the watchdog](https://osquery.readthedocs.io/en/3.3.2/deployment/debugging/#scheduled-query-failures-and-the-watchdog) for more information on osquery errors and debugging options. ## Work Process Control Flags Many of the parameters of the watchdog are controlled by default settings that can be adjusted with optional command-line interface (CLI) flags. For experienced users who need more advanced control over the osquery watchdog, such as changing the CPU and memory limits, or toggling the watchdog's monitoring functions, refer to the [osquery CLI flags documentation](https://osquery.readthedocs.io/en/3.3.2/deployment/debugging/#scheduled-query-failures-and-the-watchdog). LevelBlue only supports the agent's default watchdog settings. Adjusted settings should be tested before applying any changes to your environment. # LevelBlue Agent Use Cases Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/agents-use-cases In USM Anywhere, you can centralize the collection and analysis of Microsoft Windows event logs from your servers or desktops, making it easier to track the health and security of these systems. While the LevelBlue Agent is ideal for most traditional end-user laptop or desktop environments, there are some situations for which alternative log collection options, such as NXLog, may be preferable. The following table compares some of the most common use cases between the LevelBlue Agent and NXLog. **LevelBlue Agent vs. NXLog Use Cases** | Environmental Demands | Recommended Option | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | | If you need to monitor endpoints outside of the network or in remote locations where it would be impractical to deploy a sensor | LevelBlue Agent | | If you want the ability to query assets for additional forensic data as part of your investigation activities | LevelBlue Agent | | If you want the benefits of LevelBlue Labs actively monitoring endpoints with updated LevelBlue Labs rules, including active process and network activity information | LevelBlue Agent | | If you a need to restrict off-premise connections for endpoints | NXLog | | If you need complete control over agent configuration and filtering rules | NXLog | | If you have highly active servers that are required to maintain essential business functions where all or most of your resources are dedicated to the server | NXLog | ## Using the LevelBlue Agent The LevelBlue Agent provides simple installation, configuration, and management for host monitoring in USM Anywhere without requiring a lot of manual configuration and setup tasks of a third-party agent. When [installing the agent](alienvault-agents-install-windows) on a Windows host, it communicates over an encrypted channel to send data directly to USM Anywhere. The agent installation script configures a default set of folders, files, and registries to automatically support [file integrity monitoring (FIM)](../deployment-guide/admin/file-integrity-monitoring). You can set the configuration profile to manage the queries that USM Anywhere runs for an asset associated with a deployed agent. Using LevelBlue Agents is the best choice for monitoring endpoints outside of the network, in remote locations, or where deploying a sensor is impractical. Additionally, it provides the ability to query the asset for additional forensic data as part of your investigation activities. See [The LevelBlue Agent](alienvault-agents) for more information about the LevelBlue Agent and how you can use it to simplify your endpoint detection and response (EDR), FIM, and rich endpoint telemetry capabilities. ## Using NXLog You can use NXLog to collect and forward Windows events to a USM Anywhere Sensor. NXLog is a universal log collection and forwarding agent for basic Windows event logs. But it's also useful in its own right for suppressing spurious events. This is the best choice when you need complete control over agent configuration and filtering rules or must restrict cloud connections for the endpoint. There are two ways you can implement NXLog and integrate it with USM Anywhere to collect and forward events from your Windows systems: * [Install and configure NXLog Community Edition (CE) across your Windows hosts](../deployment-guide/setup/windows-events-nxlog-ce) to capture events on your end servers and forward them to your USM Anywhere Sensor. * [Use the Windows Event Collector sensor app](../deployment-guide/setup/windows-event-collector-app) to manage the NXLog subscription and forward your Windows logs directly to a deployed USM Anywhere Sensor. When you use this method, the sensor acts as the collector and the Windows host will forward the logs directly to the sensor using a private IP address, not over the public Internet. **Note:** NXLog provides an open source version and a paid, enterprise version. The USM Anywhere Sensor integration using the Windows Event Collector app is based on the enterprise version. And the custom configuration method is based on the open-source Community Edition. # LevelBlue Agent IDs Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/alienvault-agent-ids The LevelBlue Agent uses two universally unique identifier (UUID)-formatted IDs to interact with the USM Anywhere infrastructure: *a host identifier UUID* and an *asset identifier UUID*. The host identifier UUID, `hostIdentifier`, signifies a specific agent installation. This UUID is generated in one of two ways: * If you deploy the agent with the single asset deployment script, then you must choose which existing asset the deployment can be associated with or create the asset on the fly. This appends the install command with the `-assetid` flag followed by a pre-determined ID. The pre-determined ID is the asset ID of the associated asset. * If you deploy the agent with the multiple assets deployment script, then the installation process generates a random host identifier, which starts with a block of 8 zeros (`00000000-`). The agent’s host identifier UUID is stored under the `--specified_identifier` flag in the `osquery.flags` file, which is located in the following directories on the endpoint: * **Microsoft Windows**: `C:\Program Files\osquery\osquery.flags` * **Linux**: `/etc/osquery/osquery.flags` * **Apple macOS**: `/var/osquery/osquery.flags` The second ID used by the agent is the asset identifier UUID, `souce_asset_id`, which is generated by USM Anywhere whenever an asset is created. USM Anywhere uses this ID to associate events with an asset. The agent does not store its asset identifier UUID; instead, it is provided in its designated [LevelBlue Agent Configuration Profiles](agent-configuration-profiles), which is served over Transport Layer Security (TLS) to the agents as they run. **Note:** Once associated with an asset, the agent reports both its host identifier UUID and asset identifier UUID to USM Anywhere through events, providing USM Anywhere a means of correlating those events to an asset. If the agent has been deployed with the single asset deployment script, the host identifier UUID and asset identifier UUID should match. ## LevelBlue Agent ID Usage When USM Anywhere receives an event from the LevelBlue Agent, it looks for the asset ID in the metadata of the event. If the asset ID belongs to a valid and existing asset, USM Anywhere will correlate that event to the asset using that asset ID. If the agent has not been associated with an asset or the asset ID is not recognized, USM Anywhere will identify the agent as unassociated or “orphan”, on the Data Sources > Agents page. See [LevelBlue Agent and Asset Associations](agent-asset-associations) for more information on associating assets with the agents. If you install the agents using the single asset deployment script, the agents are automatically associated with their designated assets. When the agent is updated, the installation process detects the presence of an existing `osquery.flags` file and uses its `--specified_identifier` flag to identify the agent, thus maintaining its continuity. However, if you run the single asset deployment script on a host that already has an LevelBlue Agent installed, the deployment script will overwrite the `-controlnodeid` and `-assetid` flags found on the host system. ## Agent Deployments in Virtual Environments Understanding the two LevelBlue Agent IDs detailed previously is important when you deploy agents in virtual machines (VMs), especially when deploying the same image to multiple VMs. Consider the following use cases: * If the VM can be identified by the same host identifier UUID every time it starts up, then you can install the agent and snapshot the image containing the installation’s host identifier UUID in the `osquery.flags` file. **Note:** If the image is reverted to that snapshot, or applied to another machine, the same host identifier UUID will be used on each machine, and all events reported by these instances of the agent will be associated with the same asset in USM Anywhere. * If you require that every instance of the VM carries a host identifier UUID to be discernible from another instance of the same VM, then you need to set up a scheduled task to run the multiple asset deployment script at the first start-up so that a unique host identifier UUID is generated during installation. * If you are building a template, or *golden image*, to be distributed to individual systems that need to be uniquely identifiable, then you should also set up a scheduled task to run the multiple assets deployment script at the first start-up so that a unique host identifier UUID is generated during installation. In the last two use cases, each agent will be designated as unassociated by USM Anywhere because their events will contain no asset identifier information. Agents installed this way must be associated with a new or existing asset after installation. You only need to do it once per instance, and they can be done in bulk if creating new assets from the agent's associations page. See [LevelBlue Agent and Asset Associations](agent-asset-associations) for more information. **Warning:** If multiple VMs carry the same host identifier UUID and are associated with the same asset in USM Anywhere, you may see some strange behaviors. For example: * The asset changes its name from time to time. * The agent's heartbeat events appear more frequently than every 10 minutes. * The asset has alarms that are false positive because not all events aggregated under this asset originated from the same endpoint. # The LevelBlue Agent Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/alienvault-agents The LevelBlue Agent is a lightweight endpoint agent based on osquery, the leading open-source operating system (OS) instrumentation framework for Microsoft Windows, Apple macOS, and Linux. It enables endpoint detection and monitoring with central management, contributing to complete and effective threat visibility, detection, and compliance. The LevelBlue Agent is easy to install on your host and endpoints, and has a small footprint. An installed agent provides continuous endpoint security monitoring, allowing USM Anywhere to quickly detect threats on your essential assets without the time-consuming manual configuration and setup tasks required to implement and integrate a third-party tool. ## Agent IDs The LevelBlue Agent communicates over an encrypted channel to send data directly to the USM Anywhere service, bypassing the USM Anywhere Sensor, and buffers data locally when the connection to USM Anywhere is unavailable. The (OS)se agents use two universally unique identifier (UUID)-formatted IDs to interact with USM Anywhere: a host identifier UUID and an asset identifier UUID. Understanding the two LevelBlue Agent IDs is important when you deploy agents in virtual machines (VMs). See [LevelBlue Agent IDs](alienvault-agent-ids) for more information. ## Agent Data Collection Each LevelBlue Agent must be associated with an asset in USM Anywhere to enable log collection, which should match the host system where it is deployed. When this association is in place, detailed information is available in the [Asset Details](../../user-guide/asset-management/asset-administration/viewing-asset-details) page. On this page, you can view the number of events associated with the agent, as well as data consumption by the agent over a fixed period of time. When the agent is registered and associated with an asset, the agent configuration profile determines the queries and intervals that USM Anywhere uses to collect logs from the host system. The agent dashboard displays status information for all agents registered with your USM Anywhere environment, including an indication that an agent is currently sending data. See [LevelBlue Agent Dashboard](../../user-guide/dashboards/alienvault-agent) for more information. ## Agent Data Caching LevelBlue has enhanced osquery’s buffered logger to retain data more efficiently if the communication with USM Anywhere fails. Based on the frequency of events being generated on the endpoint, the LevelBlue Agent writes those events to batch files. When there is a communication error with USM Anywhere, those files are retained in `osquery3.db/z_cached_logs` within the agent’s working directory. The agent tries resending the files after a back-off period and, at the same time, continues to add more batch files for new events if the communication isn't restored. Under normal conditions, the cache of batch files shouldn't exceed 5 GB of disk space. After the communication is restored, the agent works through the backlog of files in the order of their creation. If the caching limit is reached, the agent issues a warning and stops writing cached data to disk, after which no new events are captured. You may need to remove some or all of the files to allow the agent to capture and cache new events until the communications with USM Anywhere is restored. The amount of time to reach the caching limit depends on the activity on the endpoint and the amount of content in each event. ## Agent Updates When a new agent is registered with your USM Anywhere service, the system checks its version and displays it under the associated asset. You can update the agent manually or use the agent’s auto-update feature, which is disabled by default. Both update methods are performed using the [LevelBlue Agent script](agent-script). See the LevelBlue Agent updates on the [USM Anywhere Product Announcements](https://success.alienvault.com/s/topic/0TO0Z000000oRSNWA2/anywhere-product-announcements) page to find out the latest agent version and improvement. To view other related training videos, [click here](https://cybersecurity.att.com/training/self-paced-training). # LevelBlue Agent Installation on Linux Hosts Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/alienvault-agents-install-linux To install the LevelBlue Agent on Linux, you must run a script that you access from your USM Anywhere environment. When you run the installation on the Linux host system, the script downloads a .deb or .rpm file directly from USM Anywhere, and the agent automatically registers with your USM Anywhere environment. The installation process also configures a default set of paths to automatically support [file integrity monitoring (FIM)](../deployment-guide/admin/file-integrity-monitoring). You can generate a script that is specific to a selected asset in your USM Anywhere environment or generate a bulk deployment script that you can use to install the agent on multiple Linux host systems. At this time, agent support is limited to host systems running a 64-bit operating system (OS). Dependent libraries for 32-bit OS are not available. **Note:** When you first deploy LevelBlue Agents on your host systems, you should install just a few to evaluate the events collected by the agent and the impact to your data consumption. While there is no hard limit on the number of agents you can deploy, larger numbers of agents can eventually begin to impact the performance of USM Anywhere by transmitting more data than your pipeline can accommodate, causing latency in receiving and processing information. Similarly, if your host system is consistently busy, such as a domain controller or an active directory (AD) server, deploying an agent on it may slow down its operations. **Note:** LevelBlue Agents do not currently support the use of a proxy server. **Important:** Before installing the Linux LevelBlue Agent, you should confirm that auditd is disabled on the targeted endpoint and is not configured to start at boot. This is because the agent uses syscalls to the kernel’s audit system to generate process events, which are then used in certain detection rules and queries. [Official osquery documentation](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#linux-process-auditing-using-audit) states that auditd should not be running when osquery is configured to use these syscalls because it can create a conflict with the osquery service over access to the audit Netlink socket. ## Prerequisites Before installing the LevelBlue Agent on a Linux host system, ensure that you have the prerequisites in place for that system. * The 64-bit Linux host system runs a Red Hat or Debian-based distribution, such as Ubuntu or Mint. Note: The LevelBlue Agent installation has been tested on Ubuntu 14 and 16, a recent version of CentOS, Amazon Linux, and a handful of other Linux types. It is designed to work on any Linux version on 64-bit Intel that uses either APT or RPM to install packages. * Transport Layer Security (TLS) 1.2 must be enabled on the host system. * rsyslog is installed on the host system (see [https://www.rsyslog.com/](https://www.rsyslog.com/)). * curl is installed on the host system (see [https://curl.haxx.se/download.html](https://curl.haxx.se/download.html)). * You have login credentials for the host system with sudo privileges. **Note:** LevelBlue recommends that your host system has a minimum of 4 GB memory and 2 CPU cores. You must configure your firewall to support ongoing event transmission to USM Anywhere. **Standard Firewall Setup** Your firewall needs to be configured to allow ongoing outbound connectivity from the host system using the HTTPS application protocol over port 443 to these USM Anywhere endpoints: * `-agent-entrypoint.alienvault.cloud` (for example, `eu-west-1-agent-entrypoint.alienvault.cloud`) See the [LevelBlue Agent Endpoints by AWS Regions](alienvault-agents-install-linux) table for region-specific IP ranges. * `agent-packageserver.alienvault.cloud` * `api.agent.alienvault.cloud` * `prod-api.agent.alienvault.cloud` * The package repo content is located in `agent-packageserver.alienvault.cloud/repo/deb/` or `agent-packageserver.alienvault.cloud/repo/rpm/` **Important:** The endpoints listed above are inside the 3.235.189.112/28 range. **GovCloud Setup** LevelBlue Threat Detection and Response for Government (LevelBlue TDR for Gov) customers need to configure ongoing outbound connectivity from the host system using the HTTPS application protocol over port 443 to these USM Anywhere endpoints: * `api.agent.gov.alienvault.us` * `prod-api.agent.gov.alienvault.us` * The package repo content is located in `agent-packageserver.gov.alienvault.us/repo/deb/` or `agent-packageserver.gov.alienvault.us/repo/rpm/` * `us-gov-west-1-agent-entrypoint.gov.alienvault.us` **Important:** These endpoints are inside the 3.32.190.224/28 range. For endpoints that rely on the Amazon Web Services (AWS) region, the endpoint to use depends on the AWS region where your USM Anywhere instance is deployed. See the following table for details. If you are unsure, consult the administrator who set up your USM Anywhere or LevelBlue TDR for Gov domain. **Note:** LevelBlue owns the IP ranges listed in the following table. The IP ranges route agent traffic, and connectivity can move within the ranges according to the region. **LevelBlue Agent Endpoints by AWS Regions** | Region | Endpoint | Reserved Static IP Address Ranges | | ------------------------- | ------------------------------------------------ | --------------------------------- | | Asia Pacific (Tokyo) | ap-northeast-1-agent-entrypoint.alienvault.cloud | 18.177.156.144/28 | | Asia Pacific (Mumbai) | ap-south-1-agent-entrypoint.alienvault.cloud | 3.7.161.32/28 | | Asia Pacific (Sydney) | ap-southeast-2-agent-entrypoint.alienvault.cloud | 3.25.47.48/28 | | Canada (Central) | ca-central-1-agent-entrypoint.alienvault.cloud | 3.96.2.80/28 | | EU (Frankfurt) | eu-central-1-agent-entrypoint.alienvault.cloud | 18.156.18.32/28 | | EU (Ireland) | eu-west-1-agent-entrypoint.alienvault.cloud | 3.250.207.0/28 | | EU (London) | eu-west-2-agent-entrypoint.alienvault.cloud | 18.130.91.160/28 | | South America (São Paulo) | sa-east-1-agent-entrypoint.alienvault.cloud | 18.230.160.128/28 | | US East (N. Virginia) | us-east-1-agent-entrypoint.alienvault.cloud | 3.235.189.112/28 | | US West (Oregon) | us-west-2-agent-entrypoint.alienvault.cloud | 44.234.73.192/28 | | AWS GovCloud (US-West) | us-gov-west-1-agent-entrypoint.gov.alienvault.us | 3.32.190.224/28 | ## LevelBlue Agent Installation on a Single Host System For a Linux host system that is already identified as an asset in your USM Anywhere environment, you can install the agent using a generated bash script to run on that Linux host system. You can generate this script for the specific asset from the Agents page (Data Sources > Agents) or from the [Asset Details page](../user-guide/asset-management/asset-administration/viewing-asset-details) for the asset. **Note:** If the host system is not in your asset inventory through discovery by a deployed USM Anywhere Sensor, you can manually add the asset using its IP address or fully qualified domain name (FQDN). See [Adding Assets](../user-guide/asset-management/asset-administration/adding-assets) for more information. Alternatively, you can use the script for multiple assets and then use the information provided by the unassociated agent to create a new asset. **Important:** Some antivirus software may block the osqueryd service and prevent it from starting. If your service is not starting because of antivirus software, you need to add the `/usr/bin/` path to your antivirus exclusions policy. 1. In USM Anywhere, go to **Data Sources > Agents**. 2. Click **Linux Deployment Script**. 3. In the dialog box, select the **Single Asset** tab. 4. Specify the asset where you want to install the agent. You can start typing the name or IP address of the asset in the field to display matching items and select the one you want. Or you can click the **Browse Assets** link to open the Select Asset dialog box and then browse the asset list to make your selection. 5. Select the Package Manager type for the Linux distribution. The deb type is selected by default. If the asset uses a Red Hat distribution, select the rpm type. 6. Click **Copy to clipboard**. 7. Use an SSH client to connect and log in to the asset host system. 8. Run the copied bash script. 1. Go to **Environment > Assets**. 2. (Optional) Use the **Search & Filters** option to filter the list and help you locate the asset you want. See [Searching Assets](../user-guide/asset-management/asset-administration/searching-for-assets) for more information. 3. Click the icon next to the asset name and then select **Full Details**. 4. In the Agent Status section, click **Deploy Agent**. 5. Select the **Package Manager** type for the Linux distribution. The deb type is selected by default. If the asset uses a Red Hat distribution, select the rpm type. 6. Click **Copy to clipboard**. 7. Use an SSH client to connect and log in to the asset host system. 8. Run the copied bash script. ## LevelBlue Agent Installation on Multiple Host Systems If you have multiple Linux host systems that are not currently in your USM Anywhere asset inventory or you don't want to generate a separate script for each asset, you can install the LevelBlue Agent using a generated bash script on any Linux host system that meets the prerequisite requirements and supports the package type for the script. You can generate this script from the Agents page (Data Sources > Agents). After you use the script to deploy the agent on your Linux host systems, you can view the list of unassigned agents and then associate each agent with an existing asset or add a new asset using the information provided by the agent. **To generate an agent deployment script for multiple host systems** 1. In USM Anywhere, go to **Data Sources > Agents**. 2. Click **Linux Deployment Script**. Ensure that the **Multiple Assets** tab is selected in the dialog box. 3. Select the Package Manager type for the Linux distribution. The deb type is selected by default. If the asset uses a Red Hat distribution, select the rpm type. 4. Click **Copy to clipboard**. 5. Run the script on each Linux host system where you want to deploy the agent. * Use an SSH client to connect and log in to the asset host system. * Run the copied bash script. Note: If you use a multiple asset installation script to execute bulk deployment across multiple host systems, the script will not have the unique asset ID. In this case, USM Anywhere attempts to associate the LevelBlue Agent with an existing asset if there is enough information and it can make a definitive match. When a deployed agent does not have an associated asset, you must manually make this association in USM Anywhere to enable queries and log collection for the host system. See [LevelBlue Agent and Asset Associations](agent-asset-associations) for more information. ## Installation Error Resolution If the LevelBlue Agent is installed using the single asset deployment script, its [host identifier UUID](alienvault-agent-ids) and asset association is stored in the osquery.flags file in your system. Asset changes, specifically changes that result in an asset being removed and added back to USM Anywhere, can cause issues with the way the agent associates with the asset if you need to reinstall the agent for any reason. If you encounter an error during the installation of an agent, you need to remove the osquery directory before you reinstall the agent. To do this, enter either `apt-get purge alienvault-agent` or `yum remove alienvault-agent` in the command line, and then reinstall the agent. ## Additional LevelBlue Agent Commands The LevelBlue Agent also comes with a bash script to control other features of the agent, such as starting, stopping, restarting, updating, and uninstalling the agent. See [The LevelBlue Agent Script and Agent Updates](agent-script) for more information on the agent command script, including the file location and a list of the commands. # LevelBlue Agent Installation on macOS Hosts Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/alienvault-agents-install-osx To install the LevelBlue Agent on Apple macOS, you must run a script accessible from your USM Anywhere environment. When you run the installation on a macOS host system, the script downloads a .pkg file directly from USM Anywhere, and the agent automatically registers with your USM Anywhere environment. The installation process also configures a default set of paths to automatically support [file integrity monitoring (FIM)](../deployment-guide/admin/file-integrity-monitoring). You can generate a script that is specific to a selected asset in your USM Anywhere environment or generate a bulk deployment script that you can use to install the agent on multiple macOS host systems. **Note:** When you first deploy LevelBlue Agents on your host systems, you should install just a few to evaluate the events collected by the agent and the impact to your data consumption. While there is no hard limit on the number of agents you can deploy, larger numbers of agents can eventually begin to impact the performance of USM Anywhere by transmitting more data than your pipeline can accommodate, causing latency in receiving and processing information. Similarly, if your host system is consistently busy, such as a domain controller or an active directory (AD) server, deploying an agent on it may slow down its operations. **Note:** LevelBlue Agents do not currently support the use of a proxy server. ## Prerequisites Before installing the agent on a macOS host system, ensure that these prerequisites are met: * You are running macOS Sierra 10.12 or later. * You have login credentials for the host system with sudo privileges. * Transport Layer Security (TLS) 1.2 must be enabled on the host system. Warning: The agent for macOS is not compatible with assets that have Apple Silicon M-Series CPUs. Rosetta needs to be installed for successful agent installation on Apple Silicon M-Series assets. This can be done by running the command `softwareupdate --install-rosetta --agree-to-license`. **Note:** LevelBlue recommends that your host system has a minimum of 4 GB memory and 2 CPU cores. You must configure your firewall to support ongoing event transmission to USM Anywhere. **Standard Firewall Setup** Your firewall needs to be configured to allow ongoing outbound connectivity from the host system using the HTTPS application protocol over port 443 to these USM Anywhere endpoints: * `-agent-entrypoint.alienvault.cloud` (for example, `eu-west-1-agent-entrypoint.alienvault.cloud`) See the [LevelBlue Agent Endpoints by AWS Regions](alienvault-agents-install-osx) table for region-specific IP ranges. * `agent-packageserver.alienvault.cloud` * `api.agent.alienvault.cloud` * `prod-api.agent.alienvault.cloud` * `agent-packageserver.alienvault.cloud/repo/osx/alienvault-agent-.pkg` **Important:** The endpoints listed above are inside the 3.235.189.112/28 range. **GovCloud Setup** LevelBlue Threat Detection and Response for Government (LevelBlue TDR for Gov) customers need to configure ongoing outbound connectivity from the host system using the HTTPS application protocol over port 443 to these USM Anywhere endpoints: * `api.agent.gov.alienvault.us` * `prod-api.agent.gov.alienvault.us` * `agent-packageserver.gov.alienvault.us/repo/osx/alienvault-agent-.pkg` * `us-gov-west-1-agent-entrypoint.gov.alienvault.us` **Important:** These endpoints are inside the 3.32.190.224/28 range. For endpoints that rely on the Amazon Web Services (AWS) region, the endpoint to use depends on the AWS region where your USM Anywhere instance is deployed. See the following table for details. If you are unsure, consult the administrator who set up your USM Anywhere or LevelBlue TDR for Gov domain. **Note:** LevelBlue owns the IP ranges listed in the following table. The IP ranges route agent traffic, and connectivity can move within the ranges according to the region. **LevelBlue Agent Endpoints by AWS Regions** | Region | Endpoint | Reserved Static IP Address Ranges | | ------------------------- | ------------------------------------------------ | --------------------------------- | | Asia Pacific (Tokyo) | ap-northeast-1-agent-entrypoint.alienvault.cloud | 18.177.156.144/28 | | Asia Pacific (Mumbai) | ap-south-1-agent-entrypoint.alienvault.cloud | 3.7.161.32/28 | | Asia Pacific (Sydney) | ap-southeast-2-agent-entrypoint.alienvault.cloud | 3.25.47.48/28 | | Canada (Central) | ca-central-1-agent-entrypoint.alienvault.cloud | 3.96.2.80/28 | | EU (Frankfurt) | eu-central-1-agent-entrypoint.alienvault.cloud | 18.156.18.32/28 | | EU (Ireland) | eu-west-1-agent-entrypoint.alienvault.cloud | 3.250.207.0/28 | | EU (London) | eu-west-2-agent-entrypoint.alienvault.cloud | 18.130.91.160/28 | | South America (São Paulo) | sa-east-1-agent-entrypoint.alienvault.cloud | 18.230.160.128/28 | | US East (N. Virginia) | us-east-1-agent-entrypoint.alienvault.cloud | 3.235.189.112/28 | | US West (Oregon) | us-west-2-agent-entrypoint.alienvault.cloud | 44.234.73.192/28 | | AWS GovCloud (US-West) | us-gov-west-1-agent-entrypoint.gov.alienvault.us | 3.32.190.224/28 | ## LevelBlue Agent Installation on a Single Host System For a macOS host system that is already identified as an asset in your USM Anywhere environment, you can install the agent using a generated Terminal script to run on that macOS host system. You can generate this script for the specific asset from the Agents page (Data Sources > Agents) or from the Asset Details page for the asset. **Note:** If the host system is not in your asset inventory through discovery by a deployed USM Anywhere Sensor, you can manually add the asset using its IP address or fully qualified domain name (FQDN). See [Adding Assets](../user-guide/asset-management/asset-administration/adding-assets) for more information. Alternatively, you can use the script for multiple assets and then use the information provided by the unassociated agent to create a new asset. **Important:** Some antivirus software may block the osqueryd service and prevent it from starting. If your service is not starting because of antivirus software, you need to add the `/usr/local/bin/` path to your antivirus exclusions policy. 1. In USM Anywhere, go to **Data Sources > Agents**. 2. Click **macOS Deployment Script**. 3. In the dialog box, click the **Single Asset** tab. 4. Specify the asset where you want to install the agent. You can start typing the name or IP address of the asset in the field to display matching items and then select the one you want. 5. Click **Copy to Clipboard**. 6. Use a remote access client to connect and log in to the macOS host system. 7. Open the Terminal and enter a sudo command containing the script you copied to the clipboard. 1. Go to **Environment > Assets**. 2. (Optional) Use the **Search & Filters** option to filter the list and help you locate the asset you want. See Searching Assets for more information. 3. Click the icon next to the asset name and then select **Full Details**. 4. In the Agent Status section, click **Deploy Agent**. 5. Click **Copy to Clipboard**. 6. Use an SSH client to connect and log in to the asset host system. 7. Run the copied bash script. ## LevelBlue Agent Installation on Multiple Host Systems If you have multiple macOS host systems that are not currently in your USM Anywhere asset inventory or you don't want to generate a separate script for each asset, you can install the agent using a generated Terminal script on any macOS host system that meets the prerequisite requirements and supports the package type for the script. You can generate this script from the Agents page (Data Sources > Agents). After you use the script to deploy the agent on your macOS host systems, you can view the list of unassigned agents and then associate each agent with an existing asset or add a new asset using the information provided by the agent. **To generate an agent deployment script for multiple host systems** 1. In USM Anywhere, go to **Data Sources > Agents**. 2. Click **macOS Deployment Script**. Ensure that the **Multiple Assets** tab is selected in the dialog box. 3. Select the **Package Manager** type for the macOS distribution. 4. Click **Copy to Clipboard**. Use a remote access client to connect and log in to the macOS host system. 5. Open the Terminal and enter a sudo command containing the script you copied to the clipboard. **Note:** If you use a multiple asset installation script to execute bulk deployment across multiple host systems, the script will not have the unique asset ID. In this case, USM Anywhere attempts to associate the LevelBlue Agent with an existing asset if there is enough information and it can make a definitive match. When a deployed agent does not have an associated asset, you must manually make this association in USM Anywhere to enable queries and log collection for the host system. See [LevelBlue Agent and Asset Associations](agent-asset-associations) for more information. ## Installation Error Resolution If the LevelBlue Agent is installed using the single asset deployment script, its [host identifier UUID](alienvault-agent-ids) and asset association is stored in the osquery.flags file in your system. Asset changes, specifically changes that result in an asset being removed and added back to USM Anywhere, can cause issues with the way the agent associates with the asset if you need to reinstall the agent for any reason. If you encounter an error during the installation of an agent, you need to remove the osquery directory before you reinstall the agent. To do this, delete the /var/osquery folder. ## Additional LevelBlue Agent Commands The LevelBlue Agent also comes with a bash script to control other features of the agent, such as starting, stopping, restarting, updating, and uninstalling the agent. See [The LevelBlue Agent Script and Agent Updates](agent-script) for more information on the agent command script, including the file location and a list of the commands. # LevelBlue Agent Installation on Windows Hosts Source: https://docs.levelblue.com/documentation/usm-anywhere/agents/alienvault-agents-install-windows To install the LevelBlue Agent on Microsoft Windows, you must run a script that you access from your USM Anywhere environment. When you run the installation script on the Windows host system, the script downloads an .msi file directly from USM Anywhere, and the agent automatically registers with your USM Anywhere environment. The installation process also configures a default set of folders, files, and registries to automatically support [file integrity monitoring (FIM)](../admin/file-integrity-monitoring). You can generate a script that is specific to a selected asset in your USM Anywhere environment or generate a bulk deployment script that you can use to install the agent on multiple Windows host systems. **Note:** When you first deploy LevelBlue Agents on your host systems, you should install just a few to evaluate the events collected by the agent and the impact to your data consumption. While there is no hard limit on the number of agents you can deploy, larger numbers of agents can eventually begin to impact the performance of USM Anywhere by transmitting more data than your pipeline can accommodate, causing latency in receiving and processing information. Similarly, if your host system is consistently busy, such as a domain controller or an active directory (AD) server, deploying an agent on it may slow down its operations. **Note:** LevelBlue Agents do not currently support the use of a proxy server. ## Prerequisites Before installing the LevelBlue Agent on a Windows host system, ensure that you have the following requirements in place for that system: * A 64-bit Windows host running Windows 10 or later (client version) or Windows Server 2016 or later (server version). **Note:** While it's possible to run the LevelBlue Agent on an ARM 64-bit architecture, you may see decreases in your product performance. LevelBlue does not recommend this application of the agent. * Transport Layer Security (TLS) 1.2 must be enabled on the host system. * PowerShell 3 or higher is installed on the host system. * You have login credentials for the host system with full admin rights. **Note:** LevelBlue recommends that your host system has a minimum of 4 GB memory and 2 CPU cores. You must configure your firewall to allow temporary downloads to the host system using the HTTPS application protocol over port 443: * `download.sysinternals.com/files/Sysmon.zip` You must configure your firewall to support ongoing event transmission to USM Anywhere. **Standard Firewall Setup** Your firewall needs to be configured to allow ongoing outbound connectivity from the host system using the HTTPS application protocol over port 443 to these USM Anywhere endpoints: * `-agent-entrypoint.alienvault.cloud` (for example, `eu-west-1-agent-entrypoint.alienvault.cloud`) See the [LevelBlue Agent Endpoints by AWS Regions](alienvault-agents-install-windows) table for region-specific IP ranges. * `agent-packageserver.alienvault.cloud` * `api.agent.alienvault.cloud` * `prod-api.agent.alienvault.cloud` * `agent-packageserver.alienvault.cloud/repo/windows/sysmon_config_schema4_0.xml` * `agent-packageserver.alienvault.cloud/repo/windows/alienvault-agent-.msi` **Important:** The endpoints listed above are inside the 3.235.189.112/28 range. **GovCloud Setup** LevelBlue Threat Detection and Response for Government (LevelBlue TDR for Gov) customers need to configure ongoing outbound connectivity from the host system using the HTTPS application protocol over port 443 to these USM Anywhere endpoints: * `api.agent.gov.alienvault.us` * `prod-api.agent.gov.alienvault.us` * `agent-packageserver.gov.alienvault.us/repo/windows/sysmon_config_schema4_0.xml` * `agent-packageserver.gov.alienvault.us/repo/windows/alienvault-agent-.msi` * `us-gov-west-1-agent-entrypoint.gov.alienvault.us` **Important:** These endpoints are inside the 3.32.190.224/28 range. For endpoints that rely on the Amazon Web Services (AWS) region, the endpoint to use depends on the AWS region where your USM Anywhere instance is deployed. See the following table for details. If you are unsure, consult the administrator who set up your USM Anywhere or LevelBlue TDR for Gov domain. **Note:** LevelBlue owns the IP ranges listed in the following table. The IP ranges route agent traffic, and connectivity can move within the ranges according to the region. **LevelBlue Agent Endpoints by AWS Regions** | Region | Endpoint | Reserved Static IP Address Ranges | | ------------------------- | ------------------------------------------------ | --------------------------------- | | Asia Pacific (Tokyo) | ap-northeast-1-agent-entrypoint.alienvault.cloud | 18.177.156.144/28 | | Asia Pacific (Mumbai) | ap-south-1-agent-entrypoint.alienvault.cloud | 3.7.161.32/28 | | Asia Pacific (Sydney) | ap-southeast-2-agent-entrypoint.alienvault.cloud | 3.25.47.48/28 | | Canada (Central) | ca-central-1-agent-entrypoint.alienvault.cloud | 3.96.2.80/28 | | EU (Frankfurt) | eu-central-1-agent-entrypoint.alienvault.cloud | 18.156.18.32/28 | | EU (Ireland) | eu-west-1-agent-entrypoint.alienvault.cloud | 3.250.207.0/28 | | EU (London) | eu-west-2-agent-entrypoint.alienvault.cloud | 18.130.91.160/28 | | South America (São Paulo) | sa-east-1-agent-entrypoint.alienvault.cloud | 18.230.160.128/28 | | US East (N. Virginia) | us-east-1-agent-entrypoint.alienvault.cloud | 3.235.189.112/28 | | US West (Oregon) | us-west-2-agent-entrypoint.alienvault.cloud | 44.234.73.192/28 | | AWS GovCloud (US-West) | us-gov-west-1-agent-entrypoint.gov.alienvault.us | 3.32.190.224/28 | ## LevelBlue Agent Installation on a Single Host System For a Windows host system that is already identified as an asset in your USM Anywhere environment, you can install the agent using a generated PowerShell script to run on that Windows host system. You can generate this script for the specific asset from the Agents page (Data Sources > Agents) or from the [Asset Details page](../user-guide/asset-management/asset-administration/viewing-asset-details) for the asset. Note: If the host system is not in your asset inventory through discovery by a deployed USM Anywhere Sensor, you can manually add the asset using its IP address or fully qualified domain name (FQDN). See [Adding Assets](../user-guide/asset-management/asset-administration/adding-assets) for more information. Alternatively, you can use the script for multiple assets and then use the information provided by the unassociated agent to create a new asset. **Important:** Some antivirus software may block the osqueryd service and prevent it from starting. If your service is not starting because of antivirus software, you need to add the `\Program Files\osquery\osqueryd\` path to your antivirus exclusions policy. 1. In USM Anywhere, go to **Data Sources > Agents**. 2. Click **Windows Deployment Script**. 3. In the dialog box, click the **Single Asset** tab. 4. Specify the asset where you want to install the agent. Start typing the name or IP address of the asset in the field to display matching items, and then select the one you want. 5. Click **Copy to Clipboard**. 6. Use a remote access client to connect and log in to the Windows host system. 7. Use the **Run as Administrator** option to open the PowerShell window. 8. Run the copied script. 1. Go to **Environment > Assets**. 2. (Optional) Use the **Search & Filters** option to filter the list and help you locate the asset you want. See [Searching Assets](../user-guide/asset-management/asset-administration/searching-for-assets) for more information. 3. Click the icon next to the asset name and then select **Full Details**. 4. In the Agent Status section, click **Deploy Agent**. 5. Select **Windows**. The Windows Deployment Script dialog box opens. 6. Click **Copy to Clipboard**. 7. Use a remote access client to connect and log in to the Windows host system. 8. Use the **Run as Administrator** option to open the PowerShell window. 9. Run the copied script. ## LevelBlue Agent Installation on Multiple Host Systems If you have multiple Windows host systems that are not currently in your USM Anywhere asset inventory or you don't want to generate a separate script for each asset, you can install the LevelBlue Agent using a generated PowerShell script on any Windows host system that meets the prerequisite requirements. You can generate this script from the Agents page (Data Sources > Agents). **To generate an agent deployment script for multiple host systems** 1. In USM Anywhere, go to **Data Sources > Agents**. 2. Click **Windows Deployment Script**. Ensure that the **Multiple Assets** tab is selected in the dialog box. 3. Click **Copy to clipboard**. 4. Run the script on each Windows host system where you want to deploy the agent: \= Use a remote access client to connect and log in to the Windows host system. * Use the **Run as Administrator** option to open the PowerShell window. * Run the copied script. **Note:** If you use a multiple asset installation script to execute bulk deployment across multiple host systems, the script will not have the unique asset ID. In this case, USM Anywhere attempts to associate the LevelBlue Agent with an existing asset if there is enough information and it can make a definitive match. When a deployed agent does not have an associated asset, you must manually make this association in USM Anywhere to enable queries and log collection for the host system. See [LevelBlue Agent and Asset Associations](agent-asset-associations) for more information. ## Installation Error Resolution If the LevelBlue Agent is installed using the single asset deployment script, its [host identifier UUID](alienvault-agent-ids) and asset association is stored in the osquery.flags file in your system. Asset changes, specifically changes that result in an asset being removed and added back to USM Anywhere, can cause issues with the way the agent associates with the asset if you need to reinstall the agent for any reason. If you encounter an error during the installation of an agent, you need to remove the osquery directory before you reinstall the agent. To do this, delete the `C:\Program Files\osquery` folder. ## Additional LevelBlue Agent Commands The LevelBlue Agent also comes with a PowerShell script to control other features of the agent, such as starting, stopping, restarting, updating, and uninstalling the agent. See [The LevelBlue Agent Script and Agent Updates](agent-script) for more information on the agent command script, including the file location and a list of the commands. # USM Anywhere BlueApps Guide Source: https://docs.levelblue.com/documentation/usm-anywhere/alienapps-guide/about-blueapps BlueApps extend the threat detection and security orchestration capabilities of the USM Anywhere platform to other security tools that your IT team uses, providing a consolidated approach to threat detection and response. With BlueApps, you can monitor more of your security posture directly within USM Anywhere, including your cloud services like Microsoft Office 365 and Google G Suite. BlueApps also enable you to automate and orchestrate response actions in security tools from vendors such as Cisco and Palo Alto Networks, greatly simplifying and accelerating the threat detection and incident response processes. USM Anywhere provides hundreds of BlueApps for different data sources. In addition to translating raw log data into normalized events for analysis by USM Anywhere, some BlueApps also collect and enrich log data, perform threat analysis, and provide workflow that coordinates response actions with the infrastructure and third-party applications to provide security orchestration. BlueApps extend the capabilities of USM Anywhere through integrations with leading security tools, most specifically in the following areas: * Data extraction * Correlation of data to produce events and alarms * Dashboards that display data collected from your network, which then help you visualize your environment and alert you to issues originating from a particular data source. These dashboards are visible if you have data for them. Sometimes it takes a few minutes for the dashboards to display. See [USM Anywhere Dashboards](../user-guide/dashboards/usm-dashboards) for more information. **Important:** If there are events from the last seven days, then you can see the related dashboard. When there are no events from the previous seven days, that dashboard doesn't display. * Orchestration ability that enables you to automate your security operations in a variety of ways. For example, if USM Anywhere finds data associated with a malicious website, orchestration rules might stipulate for this information be sent to the third-party vendor for immediate action. BlueApps with orchestration features are called Advanced BlueApps. **Edition:** All Advanced BlueApps are available in the Standard and Premium editions of USM Anywhere. The USM Anywhere Essentials edition only has the following Advanced BlueApps: * BlueApp for G Suite * BlueApp for McAfee ePO * BlueApp for Office 365 * BlueApp for Okta * BlueApp for Sophos Central * Amazon Web Services (AWS) Log Collection (with an AWS Sensor deployed) * Google Cloud Platform (GCP) Log Collection (with a GCP Sensor deployed) * Microsoft Azure Log Collection (with an Azure Sensor deployed) See the [Affordable pricing to fit every budget](https://levelblue.com/pricing) page for more information about the features and support provided by each of the USM Anywhere editions.