Provisioning Lumeta SPECTRE via AWS Sign in to the Amazon Web Services console at

Transcription

1 Thank you for choosing Lumeta SPECTRE! This document provides the essentials you ll need to make sense of your network in real time from the Amazon Web Services (AWS) cloud, including: 1) How to instantiate a Lumeta SPECTRE Command Center from AWS, 2) How to license your new application, and 3) How to configure zones and collectors. Provisioning Lumeta SPECTRE via AWS 1. Sign in to the Amazon Web Services console at 2. In the Explore AWS section, select AWS Marketplace. 3. In the Search bar, enter Lumeta. 4. Select LUMETA_SPECTRE_CC_BYOL_AMI, and then click Continue. 5. Select an instance type (i.e., the type of virtual server). Lumeta recommends m4.2xlarge. 6. Click Next: Configure Instance Details.

2 7. Select the subnet to which you want the instance to belong. 8. Click Next: Add Storage and accept the default values.

3 9. Click Next: Tag Instance. 10. Click Next: Configure Security Group Use the settings shown in the illustration, below. 11. Click Review and Launch and then Launch.

4 12. Select or create a private key pair (and be sure to download this important information). The private key pair is required at first login. On subsequent logins, you can use either the private key pair or the user identifier admin and a password you set during the initial system configuration of SPECTRE. 13. Click Launch Instances. The system begins its Initializing Instance Launch process. When the process has completed, the Launch Status page displays. 14. Click Open Your Software on AWS Marketplace. Your SPECTRE instance is running. The EC2 dashboard of instances displays your newly created SPECTRE instance.

5 Licensing SPECTRE (BYOL) Contact Lumeta with your SPECTRE system identifier (i.e., UUID) to initiate the license-fulfillment process. Access your UUID through the console s command-line (CLI) prompt, as described here. 1. Log in to your SPECTRE system through the Amazon Key, making sure your permission for the key is set to 600, and display your UUID as follows: - Enter ssh i <your PEM filename> admin@<ip of your instance provided by AWS> - Enter the command system hardware-id to display your UUID. 2. Record or copy the UUID. 3. Copy-paste the UUID to an message and send it to sales@lumeta.com. 4. Lumeta will fulfill your license request, set up an account for your organization, and provide you with login credentials to your SFTP account folder. This folder will contain your license key file and login credentials to Lumeta Support ( 5. Store the license key file on your local system in a /tmp directory. 6. Log in to the CLI again: ssh i <your PEM filename> admin@<ip of your instance provided by AWS> 7. Install the license by entering the CLI command: certificate spectre install /tmp/<your license file>. Congratulations! You are now a fully licensed user of Lumeta SPECTRE on AWS. 8. Log out of the CLI. 9. Log in to your SPECTRE system through the Amazon Key again as by entering the command: ssh i <your PEM filename>ec2-admin@<ip of your instance provided by AWS> 10. Set a password your admin can use to log into SPECTRE from the graphical user interface (GUI) by entering this command: user password admin <password for admin>. 11. At the bash prompt, run this script: sh /tmp/restart_service. Congratulations! Your Lumeta SPECTRE system is ready for use! Log in from your browser interface to get started.

6 Configuring a Zone & Collectors To get up and running in Lumeta SPECTRE, you ll need to familiarize yourself with zones, collectors, and the configuration of zones and collectors. You can gain this familiarity by checking out Hello World #1, the zone and collector configuration that is described here and provided as an XML download on the Lumeta Support site. Look at this collector configuration as is on your SPECTRE Command Center. Then replace its list members with equivalents that describe a sandbox subnet or another practice environment within your organization's network discovery space. Lumeta recommends that you first exercise the revised configuration in your lab or in a testing environment where you can gain experience importing and adjusting the collector configuration. There you can also see the interplay between a collector's configuration and what is discovered. This experience will help prepare you to run the revised configuration in your production environment. Lumeta Support and your account representative are available to help throughout your product orientation. Current contact information is available on our website at Introducing Hello World #1 Hello World #1 is a zone and collector configuration designed to index the IPs and CIDRs contained in a Target List. In this configuration, a single collector directs its connected Scout to actively discover only the IPs and CIDRs explicitly listed on your organization's Target List. The configuration is relatively straightforward: It does not leverage passive discovery methods, it does not trace to discovered hosts, and it does not pursue discovered IPs or CIDRs. Information is not shared among multiple collectors in the zone. The collector only "goes after" IPs/CIDRs on its Target List. It shows what SPECTRE can discover with a one collector, fewer scan phases, and the use of fewer protocols. This configuration is recommended for preliminary forays through a discovery space and early exploration of a network. Introduce yourself to discovery with this configuration. Then adjust it as you come to understand your network and the SPECTRE system better. Try other configurations that match your organization's goals and use cases. To see Hello World #1 on your Lumeta Spectre Command Center, import the configuration file, associate the Hello World collector with a Scout interface, and then enable/start the collector as described here: 1. Download Hello World Collector Configurations.xml to your local system. (This file also contains other configurations in the Hello World series.) 2. Import the downloaded XML file to your Lumeta SPECTRE Command Center the SPECTRE browser interface by clicking Settings > Support Tools > Import/Export System Configuration.

7 3. Select a Scout interface: a. Browse to Settings > Zones. b. Select a zone name such as Hello World #1. 4. On the Zone Collectors tab, select the name of a collector such as Hello World 1A and click Edit. 5. Select a Scout interface such as training-scout-1:eth0 from the Interface dropdown list. 6. When you are ready to initiate collection activity, select the Enable checkbox and click Submit. (Otherwise, just click Submit to save your settings.) 7. Confirm connectivity and discovery activity. Any of the following checks will enable you to monitor an aspect of discovery. a. Where are tools for monitoring discovery located? Browse to Settings > Support Tools to confirm activity. b. Are the Command Center and Scout connected? Ping the Scout from your Command Center (Ping Test). c. Is the discovery process running? Check discovery activity by running the "top" command (List of Processes). d. What other processes are running (or not running)? Check the status of SPECTRE's Discovery Agent (Status of SPECTRE Components). e. Check the All Notifications report Reports > Browse Real-Time > All Notifications> to make sure there is collector activity. Congratulations on successfully instantiating, licensing, and configuring Lumeta SPECTRE on AWS! Log in to Lumeta Support for full product documentation and a variety of additional learning resources to support your journey to a network that makes sense.