AppDefense Plug-In. VMware AppDefense 2.0

Transcription

1 VMware 2.0

2 You can find the most up-to-date technical documentation on the VMware website at: If you have comments about this documentation, submit your feedback to VMware, Inc Hillview Ave. Palo Alto, CA Copyright 2018 VMware, Inc. All rights reserved. Copyright and trademark information. VMware, Inc. 2

3 Contents Plug-In 5 1 Plug-In Overview 6 Appliance Connectivity Modes 6 System Requirements For 9 Hardware Requirements 10 2 Installing With Plug-In 12 Preparing for Installation 13 Step 1 A: Install the Appliance 14 Step 1 B: Register Appliance With vcenter Server 16 Step 2: Install the Host Module 21 Step 3: Install the Guest Module 23 After Installation 43 3 Using Appliance 44 Appliance Connectivity Modes 47 Configure NTP Server Settings 49 Log In to Appliance With Certificate 50 4 Using Plug-In 52 Using the Dashboard 52 Using In vsphere Client 53 5 Upgrading Plug-In 55 Configure Upgrade Strategy 57 Overall Upgrade Process 59 6 Integrating With Other Products 63 7 Uninstalling Plug-In 64 Uninstall Appliance 64 Uninstall Plug-In 65 Uninstall the Host Module 66 Uninstall the Guest Module 67 8 Troubleshooting 69 Monitoring and Searching Logs With Appliance 70 VMware, Inc. 3

4 Log Settings 72 Export Logs 73 Collecting Logs Manually 75 How to Secure JMX Communications 75 How to Verify Appliance Connectivity Manually 76 Appliance Not Getting an IP Address from DHCP Server 77 Configured Static IP Address for Appliance Is Not Working 78 How to Reset Password For Appliance Administrator 78 Virtual Machine Shows Status as Critical 79 Guest Module Upgrade Fails 79 VMware, Inc. 4

5 The Plug-In provides information about how to install, configure, and use VMware Plug-In for vcenter Server to secure applications. The information includes step-by-step configuration instructions, and suggested best practices. Intended Audience This information is intended for anyone who wants to install, configure, and use plug-in. The information is written for experienced Windows or Linux system administrators who are familiar with virtual machine technology and data center operations. This manual assumes familiarity with VMware vsphere, including VMware ESXi, vcenter Server, vsphere Client, and VMware Tools. VMware Technical Publications Glossary VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions of terms as they are used in VMware technical documentation, go to VMware, Inc. 5

6 Overview 1 The Plug-in for Platinum Edition integrates application security capabilities directly in the vsphere Client. The plug-in provides high-level security metrics about your environment, deep visibility into the behavior of individual VMs, and end-to-end lifecycle management for components. The plug-in is supported only in the HTML5 version of the vsphere Client. To install, an OVF/OVA template deploys an on-premises Appliance which connects to the vcenter Server through a registration process. After the registration is complete, Appliance installs the plug-in and collects inventory from the vcenter Server. You can then install Host Module on your ESXi host and Guest Module on the virtual machines where your application workloads are running with one click. The Dashboard in the vsphere Client shows summary of the hosts and VMs where is installed. Dashboard also displays high-level statistics on the overall cyber hygiene of your environment. You can navigate to the Manager from the plug-in to create a scope, learn behaviors, and then protect the application by taking remediation action. This chapter includes the following topics: Appliance Connectivity Modes System Requirements For Hardware Requirements Appliance Connectivity Modes The Appliance has three connectivity modes: Online, Offline, and SaaS to meet your compliance requirements. You must select the correct mode while working with plug-in. You can select the required connectivity mode while registering Appliance with vcenter Server. VMware, Inc. 6

7 Connectivity Mode Offline Online SaaS Description Available only with the Platinum edition. Offline mode configures the Appliance to operate locally (no Internet connectivity). Process and network visibility is available in this configuration. Available only with the Platinum edition. In the Online mode, like Offline mode, all application behavior is stored in the data center. However, Online mode enables to download security feeds from the Service. These feeds deliver additional visibility and security context to process and network behavior. Also, new versions of the software can be downloaded from an external upgrade portal. Available with a SaaS subscription (included in the Platinum edition). SaaS mode enables the complete feature set. SaaS features include: Scope/service assignments Behavior analysis with Machine Learning Alarms and alarm classification Custom remediations Application topology maps Third-party integrations and more You can access to this functionality through Manager by subscribing to the Service (SaaS). For details, refer to Getting Started. Online Mode Online mode stores all data on-premises, but enables the retrieval of reputation feeds from the Service. Online mode enables a subset of features, including trust and threat scores for processes in the plug-in and virtual machine monitoring pages. Online mode is the default mode for the plug-in. VMware, Inc. 7

8 Manager Cloud On-premises vsphere Workloads Outbound-only, no configuration 3 Guest OS Guest Module Guest OS Guest Module Guest OS Guest Module Plug-in vcenter Server 1 Appliance 2 Host Module vsphere Host If you have an Internet connection, but no subscription to the Service (SaaS), you can use the Online mode. Online mode gathers all the required data from the cloud, and displays the reputation scores on the configured plug-in in the vsphere Client. When you have installed plug-in, you can view analysis of processes in the Dashboard from the vsphere Client. SaaS Mode SaaS mode is available with the SaaS subscription (included in the Platinum edition). SaaS mode enables the complete feature set. Manager Cloud On-premises vsphere Workloads Full SaaS configuration 3 Guest OS Guest Module Guest OS Guest Module Guest OS Guest Module Plug-in vcenter Server 1 Appliance 2 Host Module vsphere Host SaaS features include: Scope/service assignments VMware, Inc. 8

9 Behavior analysis with Machine Learning Alarms and alarm classification Custom remediations Application topology maps Third-party integrations and more You can access this functionality through the Manager by subscribing to the Service (SaaS). For details, refer to Getting Started. When you have installed plug-in, SaaS mode gathers all the required data from the cloud and displays that data on the configured plug-in in the vsphere Client. You can view analysis of processes in the Dashboard from the vsphere Client. You can go to the Manager from the Dashboard in the vsphere Client. You can then create a scope and take the remediation action from the Manager. Offline Mode You can use the offline mode without Internet connectivity. Offline mode provides process and network visibility. On-premises vsphere Workloads 3 Guest OS Guest Module Guest OS Guest Module Guest OS Guest Module Plug-in vcenter Server 1 Appliance 2 Host Module vsphere Host When you have installed plug-in, you can view analysis of processes on the Dashboard. Status of all the processes is displayed as unverified from the vsphere Client. System Requirements For Before you install or upgrade, consider your network configuration and resources. You can install one Appliance per vcenter Server. Note The scale limit for the virtual machine (VM) with installed is 1000 VMs. supports up to 200 hosts, with maximum of 50 VMs per host. VMware, Inc. 9

10 Table 1 1. Required Components Product/Component Description Supported Version VMware vcenter Server VMware vcenter Server VMware ESXi VMware Tools VMware NSX Data Center for vsphere (optional) VMware vrealize Automation (optional) Used to manage the ESXi infrastructure. You can install plug-in for Platinum edition. Used to manage the ESXi infrastructure. You can install without plugin from Service. Hypervisor where virtual infrastructure is spawned. Guest Virtual Machine needs VMware Tools installed. Guest Module is bundled with latest VMware Tools. To leverage the network virtualization, integrate with NSX and use for remediation actions. Provisioning system to manage a deployment of the application. 6.7 U1 and above The plug-in is supported only in the HTML5 version of the vsphere Client. 6.5.x 6.5 U1 and above Recommended is latest version. Supported and above 6.3 and above 7.2 Windows Guest Operating System Windows Server 2008 R2 x64 Windows Server 2012 x64 Windows Server 2012 R2 x64 Windows Server 2016 x64 Note Windows guest operating system with Virtualization-based security (VBS) feature enabled is NOT supported. Linux Guest Operating System CentOS - 7.1,7.2,7.3, 7.4 (x86_64) RHEL - 7.0, 7.3, 7.4 (x86_64) Ubuntu , (x86_64) SUSE , 12.2, 12.3 (x86_64) Supported Browsers Internet Explorer 11 or Microsoft Edge, Google Chrome Hardware Requirements Before you install or upgrade, your system hardware must meet the following requirements. You can install one Appliance per vcenter Server. Appliance Hardware Requirements Appliance Memory Disk Space vcpu Requirements 24 GB 186 GB 16 vcpu VMware, Inc. 10

11 Host Module Hardware Requirements Host Module Memory Disk Space Requirements Minimum 256 MB 15 MB Guest Module Hardware Requirements for Windows System Guest Module Windows Memory Disk Space vcpu Requirements 512 MB 20 MB (Driver and Service binaries) 1 vcpu 4 vcpu for In-Memory Process Forensics (IMPF) service Guest Module Hardware Requirements for Linux System Guest Module Linux Memory Disk Space vcpu Requirements 1 GB 5 MB 1 vcpu Special Hardware Requirement Component ESXi host Requirements Make sure that the cpuhwmmusupported flag is true for the physical CPU. VMware, Inc. 11

12 Installing With Plug-In 2 Appliance is installed as a virtual appliance (packaged as an OVA file) on any ESXi host in your vcenter Server environment. Once installed, you must register Appliance with the vcenter Server to import host and virtual machine inventory to. You can also select the connectivity mode for your Appliance, enabling additional features as part of the Service (SaaS). If you have subscribed to the Service (SaaS), you can go to the Manager from the Dashboard using the vsphere Client. From the Manager, you can create scopes and services, analyze behavior, take remediation action on deviations from the intended state, and much more. For more information on Service, refer to Getting Started. Plug-In Install Steps Installation Step System Requirements: Verify that the version and hardware requirements for the following components are correct. vcenter Server ESXi Host Task System Requirements For Hardware Requirements VMware Tools Windows Guest Operating System Linux Guest Operating System Step 0: Obtain the plug-in installer. Step 1 A: Install Appliance on-premises in the vcenter Server. Step 1 B: Register Appliance with vcenter Server. Step 2: Install the Host Module on the ESXi host. Step 3: Install the Guest Module on the hosts where your application workloads are running. Obtain the Plug-In Installer Step 1 A: Install the Appliance Step 1 B: Register Appliance With vcenter Server Step 2: Install the Host Module Step 3: Install the Guest Module This chapter includes the following topics: Preparing for Installation Step 1 A: Install the Appliance VMware, Inc. 12

13 Step 1 B: Register Appliance With vcenter Server Step 2: Install the Host Module Step 3: Install the Guest Module After Installation Preparing for Installation This section describes licensing requirements for the plug-in, and how to obtain the installer for installation. Licensing of Plug-In for Platinum Edition VMware vsphere Platinum Edition consists of two parts: VMware Plug-In and VMware Service (SaaS) combined in a single license. VMware plug-in becomes available with the vsphere Platinum license. When you add the license key for the Platinum edition, the icon appears in the left navigation pane of the vsphere Client. You can now install and use the plug-in to protect your application and ensure endpoint security. VMware Service (SaaS) is a VMware cloud hosted service which requires an active subscription to use the service. Service (SaaS) subscription is included with the Platinum license. For more information on Service, refer to Getting Started. Obtain the Plug-In Installer The Appliance with the software for Host Module and Guest Module for the Windows system are all bundled in a single Open Virtualization Appliance (OVA) that is used for the complete installation. You must have the Appliance OVA for installation. You can obtain the Appliance OVA using the following ways: Using the VMware Downloads page. You have the vsphere Platinum license. Using the Manager, if you have subscribed to the Service (SaaS). For more details on how to sign up for Service (SaaS), refer to Getting Started. Procedure 1 Using the Downloads page. Download the Appliance installer from the VMware website at is listed under Datacenter & Cloud Infrastructure > VMware vsphere > Platinum or under Networking & Security. VMware, Inc. 13

14 2 Using the Manager. If you have the Service (SaaS) subscription, you can use Manager. a b c Log in to the Manager. At the bottom of the left navigation pane, click the settings ( Click Downloads, and then click the Appliance tab. ) icon. The appliance version is displayed with the latest appliance OVA file. d You can either copy the download URL, or download the OVA file to your computer manually. To prevent any downgrade attack, download the Appliance OVA using an encrypted channel. To copy the download URL, right-click the download link and then click Copy Link. To download the Appliance OVA file, click the Download link under the Download column. Note If you have downloaded the OVA file manually, click the Copy to Clipboard icon and verify the OVA file with the SHA256 signature provided in the Downloads table. The Appliance OVA file is obtained. What to do next Install the Appliance OVA as described in Step 1 A: Install the Appliance. Step 1 A: Install the Appliance You must deploy the Appliance on-premises in the management cluster. Install the Appliance on a different host from the actual application VMs. Prerequisites You have the Appliance OVA file. For details, refer to Obtain the Plug-In Installer. You have verified the system requirements, especially version of the vcenter Server. For details, refer to System Requirements For. Procedure 1 Log in to the vsphere Client. 2 Right-click the host where you want to install the Appliance, and then click Deploy OVF Template. VMware, Inc. 14

15 3 On the Deploy OVF Template page, configure the following values, and click Next. Option Select an OVF Template Select a name and location Select a compute resource Review details License agreements Select storage Select networks Description Paste the Appliance URL, or click Choose Files to select the downloaded OVA file on your computer. (Optional) Change the name of the OVA file to Appliance. (Optional) Verify if the selected host is the correct resource where you want to deploy the Appliance. Review the details. The Product must be Appliance VA. To accept the VMware license agreements, click I accept all license agreements. Select a host or cluster on which you want to deploy the Appliance. Select the network that has connectivity to vcenter Server and NSX Manager (If necessary). IP Allocation Settings: Select IP protocol as IPv4 or IPv6. Customize template a Application: Type passwords for the admin and root user accounts and make sure that the password length meets the character requirements. You need these passwords later while registering with vcenter Server. The password must meet the following requirements: At least eight characters At least one lowercase character At least one numeric character At least one special character Not more than 20 characters long b Networking Properties: If you want DHCP to be available while configuring the appliance, leave the configuration values empty. If you want to configure the static IP address, ask your network administrator and add the following mandatory values: Default Gateway, Domain Name Servers, Network 1 IP Address, Network 1 Netmask. Ready to complete Verify the details and click Finish. Note Even though the DHCP configuration is used, the Review configuration data > Properties section shows that the static IP configuration is used. Ignore data displayed under the Properties section. The OVF begins to import and deploy. It can take some time, depending on public network download speed. 4 After the deployment is complete, go to the Appliance virtual machine (VM), and power on the VM. The icon appears in the left navigation pane of the vsphere Client. To view the Home page, click the icon. VMware, Inc. 15

16 The > Getting Started page appears. Clicking the Getting Started navigates you to this Installation Guide. The Getting Started page gets replaced with the Dashboard page after you configure Appliance. What to do next Register the Appliance with vcenter Server. Step 1 B: Register Appliance With vcenter Server After the Appliance is installed, you must register the new appliance with vcenter Server. Prerequisites You have installed the Appliance. The Appliance VM is powered-on. Procedure 1 Log in to the vsphere Client. 2 Go to the Appliance VM, and verify that the VM is powered-on. Note down the Appliance IP address. 3 Open a web browser, and navigate to Appliance GUI at ip address>. The Select a certificate window appears. VMware, Inc. 16

17 4 You can log in to the Appliance using either the admin credentials or using the certificate. a If you want to log in to the Appliance using the admin credentials, click Cancel. Use the admin credentials that you added while installing the Appliance OVA file. Important Do not click OK to accept the certificate. b If you want to log in to Appliance using self-signed or CA certificate, then follow the procedure as described in the Log In to Appliance With Certificate topic. The Dashboard appears as a default home page. 5 Go to the Configuration > Registration tab. 6 In the Manager section, click Edit and configure the following values. VMware, Inc. 17

18 7 From the Choose Connectivity mode list, select the required mode of operation. For more information on connectivity modes, refer to Appliance Connectivity Modes. Option Offline Online SaaS Description Available only with the Platinum edition. Offline mode configures the Appliance to operate locally (no Internet connectivity). Process and network visibility is available in this configuration. Online mode is the default mode for the plug-in. Available only with the Platinum edition. In the Online mode, like Offline mode, all application behavior is stored in the data center. However, Online mode enables to download security feeds from the Service. These feeds deliver additional visibility and security context to process and network behavior. Also, new versions of the software can be downloaded from an external upgrade portal. You see the Manager URL is displayed. Do not change the URL. Available with a SaaS subscription (included in the Platinum edition). SaaS mode enables the complete feature set. You can access to this functionality through Manager by subscribing to the Service (SaaS). For details, refer to Getting Started. Refer to the following table for information that you must provide to configure the SaaS mode. Prerequisite: Provision the Appliance as follows. For more information, refer to Step 1B: Provision the Deployed Appliance in the Installing. a Log in to Manager. b Click the settings icon > Appliance > Provision New Appliance page. The New Appliance window appears. c Create an appliance by entering the appliance name, and then click Provision. The appliance name is an identifier and does not need to match the actual VM name within the vcenter Server, but the best practice is to match the names. For example, Appliance. The New Appliance Created window appears. d e Create an appliance by entering the appliance name, and then click Provision. The New Appliance Created window displays the URL for the manager in the region, UUID, and appliance API key. Keep this window open until the appliance configuration is done, or note down the information and preserve to use in SaaS configuration. SaaS mode Manager URL Description URL of the Manager. Enter the appropriate URL based on your region. For example: US region: UK region: Frankfurt region: VMware, Inc. 18

19 SaaS mode Description Sydney region: Manager UUID Enter the goldilocks.appliance.uuid obtained from the Manager. For example, goldilocks.appliance.uuid=xxxxxx1-axxx-4xxx-axxxdxxxxxxxxxx5. Manager API key Enter the goldilocks.appliance.api-key obtained from the Manager. For example, oldilocks.appliance.apikey=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. Click Save. VMware, Inc. 19

20 8 In the SSO lookup configuration section, click Edit and configure the following values. Note Time must be synchronized between the Appliance and the vcenter Single Sign On (SSO) server. NTP server must be specified so that the SSO server time and the Appliance time are in sync. For details on how to configure NTP server, refer to Configure NTP Server Settings topic. SSO lookup configuration Host name User name and Password Thumbprint (SHA1) Description Enter the host name of the vcenter Single Sign On (SSO) and click Register. You must have time synchronization between SSO server and the Appliance. Enter user name and password for the vcenter SSO administrator. To add a member to the vcenter SSO administrator group, refer to the vsphere documentation available at vsphere/6.7/com.vmware.psc.doc/guid-cdea6f E0B44C11D80D.html. Verify the SHA1 thumbprint of the SSO server. Note Appliance uses a service account to interact with vcenter. This service account is created in your SSO server for the improved security and manageability. You need SSO administrator credentials for creating this service account. The SSO administrator credentials are only used for this session and are not persisted in. 9 In the vcenter Server details section, configure the following values. vcenter Server details vcenter Server Host name Thumbprint (SHA256) Description Select the required vcenter Server host name from the list to be protected by. You can install one Appliance per vcenter Server. Verify the SHA256 thumbprint of the vcenter Server. Click Register. 10 If the vcenter Server is configured with the NSX Data Center for vsphere, the NSX details section displays the configured values. If you want to configure NSX, click Register and enter the following values. NSX details NSX host name User name and Password Thumbprint (SHA256) Description NSX Data Center for vsphere host name. Click Register. Enter user name and password for the NSX administrator. Verify the SHA256 thumbprint of the NSX server. Note Make sure that Appliance and NSX are on common network as vcenter Server. Click Register. VMware, Inc. 20

21 The Appliance is registered with the vcenter Server. The > Getting Started page gets replaced with the > Dashboard page. Log out and log in to the vcenter Server again with the same Administrator role used to register Appliance. Alternatively, refresh the vsphere Client browser to reflect the changes. After the Appliance is registered with vcenter Server, you can log in to the Appliance using the vsphere user credentials (for example, as well. What to do next Install Host Module. The panel appears on the Summary and Configuration tab for any host in the vcenter Server inventory. You can install, upgrade, or view details about from the panel. Step 2: Install the Host Module You must set up the Host Module on the ESXi host. Host module enables communication from the Guest Module to the Appliance. The vsphere installation bundle (VIB) named glxhost is installed on the ESXi host after is deployed. The Appliance must communicate with the ESXi hosts on the management network. Refer to VMware vsphere networking best practices for details. After you install and register Appliance, you can install Host Module as follows: Cluster: On all hosts with a single click from the Cluster > Configuration, and click Enable For All Hosts. -OR- On the Summary tab, scroll down to the panel, and click Enable. Host: Each host individually from the Summary tab, scroll down to the panel, and click Install. -OR- On the Configuration tab, and click > Security and click Install. Prerequisites You have installed and registered Appliance. Procedure 1 To install Host Module on each host individually, go to the host where you want to install Host Module. VMware, Inc. 21

22 2 On the Summary tab, scroll down to the panel. If necessary, expand the panel. Alternatively, you can go to Configuration tab, and click > Security. 3 Click Install. A confirmation box appears. 4 Click OK. The Host Module gets installed. A new task for the host module install appears in the Recent Tasks pane. You can see status of the install task. VMware, Inc. 22

23 5 (Optional) To install Host Module on all hosts with a single click, go to the Cluster > Configuration, and click Enable For All Hosts. Alternatively, you can go to the Summary tab, scroll down to the panel and click Enable. The Host Module is installed on all hosts in that cluster. After the task is finished, the Host Module is installed. What to do next Install the Guest Module on the virtual machines (VM) where your application workloads are running. Step 3: Install the Guest Module You must install the Guest Module on the virtual machines (VM) where your application workloads are running. You can install Guest Module on: Install Guest Module for Windows System VMware, Inc. 23

24 Installing the Guest Module on Linux System Important does not work with virtual machines that have Fault Tolerance enabled. This limitation applies to both Linux and Windows guest virtual machines. Note If the resource allocation like CPU or memory is changed at any time, then reboot the guest VM. Install Guest Module for Windows System You must install the Guest Module on the virtual machines (VM) where your application workloads are running. You must have VMware Tools installed on the guest VM. installs or upgrades VMware Tools version to the latest available version, and installs the guest integrity module on the virtual machine. If the VM version is earlier than 13, upgrades the VM hardware version to the latest available version. If you do not want to upgrade the VM version automatically, you must upgrade the VM version manually to version 13 or later. Follow the Knowledge Base Article for upgrading a VM to the latest hardware version. Guest Module is bundled with the latest VMware Tools. If you do not have latest VMware Tools version installed on the VM, then you must upgrade VMware Tools to the latest version. Prerequisites You have installed and registered Appliance. You have installed the Host Module. Verify the Windows operating system and VMware Tools version installed on the VM where you want to install the Guest Module. For details, see System Requirements For. Procedure 1 Go to the VM where you want to install Guest Module. 2 On the Summary tab, scroll down to the panel. If necessary, expand the panel. Alternatively, you can also use the Configure > > Security tab. 3 Click Install. A confirmation box appears. Note The installation process reboots the virtual machine, which can take five minutes. 4 Click OK. The Guest Module gets installed. A new task for the guest module install appears in the Recent Tasks pane. After the task is complete, the Guest Module is installed. VMware, Inc. 24

25 What to do next After installing the Host Module on the ESXi host and Guest Module on VMs where your application workloads are running, you can start using plug-in in the vsphere Client to monitor processes that are running on your applications. The Dashboard in the vsphere Client shows summary of the hosts and VMs where is installed. Dashboard displays overall processes based on the security risk detected by. engine monitors data and displays the process reputation. Installing the Guest Module on Linux System You can install Guest Module on the supported Linux system. The installation of Guest Module installs the package, Guest Introspection package, and the netfilter dependencies. Guest Introspection is a service that is deployed to offload security functions to a dedicated security appliance on each host. As a result, Guest Introspection removes the need for an antivirus agent within the guest operating system. Guest Introspection uses the following netfilter libraries to provide connection control and connection monitoring capability to the. libnetfilter_queue: Provides APIs to capture network packets. libnetfilter_conntrack: Provides APIs to track network connection status. Linux Installation Package The Linux installation packages are available at the following two locations. 1 Package Repository: 2 Downloads Repository: Linux Installation Options You have the following options to install Guest Module on the supported Linux system. Install Guest Module on Linux System Using VMware Package Repository: Preferred method for installation. Install Guest Module on Linux System Using the Downloads Repository: If you cannot access the VMware package repository ( or you cannot access the operating system (OS) repository to install the netfilter dependencies, then you can install Guest Module on guest Linux virtual machines (VM) using the Downloads (appd-dl.vmware.com) repository. Install Guest Module on Linux System Using Local Download: If you do not have Internet access, then you can download the complete installation package and then configure the Guest Module on the required guest Linux virtual machines (VM) pointing to the local repository. Install Guest Module Using Package Manager Command: If you do not want to configure the repository, you can use this method. VMware, Inc. 25

26 Known Limitations for Linux VMs There are few known limitations for to work with Linux VM. For details, refer to the Known Limitation With Linux VMs. Guest Module Install Prerequisites for Linux Systems You must verify the following components on the virtual machine before the actual installation. The solution works with Guest Introspection for VMware NSX (VMware open-source product) to provide a network attestation service. Ensure that the guest virtual machine (VM) has: 1 ESXi 6.5 U1 or later is installed. 2 A supported version of Linux is installed. See System Requirements For for the list of supported Linux distributions and versions. 3 iptables package of version or later is installed. 4 Verify glib 2 is installed on the Linux VM. There are few known limitations for to work with Linux VM. For details, refer to the Known Limitation With Linux VMs. Known Limitation With Linux VMs The following section describes the known problems of with Linux VM. Solution 1 Problem: Guest driver uses the VMware Virtual Machine Communication Interface (VMCI) channel to communicate with the host. Virtual Machine Communication Interface (VMCI) is an upstream gateway and has a known problem with the VMCI with vsock ( k), vmw_vsock_vmci_transport ( k), and vmw_vmci ( k) drivers. To work around this problem, upgrade the mentioned drivers to the versions suggested by the Linux distribution. 2 Problem: does not work in virtual machines that have Fault Tolerance (FT) enabled. The underlying infrastructure required by does not work with Fault Tolerant virtual machines. This limitation applies to both Linux and Windows guest virtual machines. On fault tolerant systems, drivers do not run due to VMCI Interop issues. You must disable the fault tolerance. For more information about disabling fault tolerance, refer to the Knowledge Base Article. VMware, Inc. 26

27 3 Problem: The parent process command-line Information is shown to provide more information about the process. Sometimes, the parent process command-line Information is not correct or reliable. The parent process information is not being used for any policy making or decision. Following information is displayed for the processes that exist when the guest agent starts. Process binary absolute path. Process MD5 and SHA256 hashes. Command line the process started with PID (process identity). Following information is displayed for the processes that are created after the guest agent starts. Parent Process binary absolute path. Parent Process MD5 and SHA256 hashes. Parent Command line the process started with PPID (parent process identity). Install Guest Module on Linux System Using VMware Package Repository You can install Guest Module on guest Linux virtual machines (VM) where your application workloads are running using the VMware package repository. The Linux VM (or server that is used to supply binaries to VMs) must be able to access The installation of Guest Module installs the package, and the Guest Introspection package. Perform the steps as applicable for your Linux distribution. Prerequisites You must complete the prerequisites before the actual installation. For details, refer to Guest Module Install Prerequisites for Linux Systems. The Linux VM (or server that is used to supply binaries to VMs) must have access to To verify accessibility to packages.vmware.com, use the ping packages.vmware.com command. Then run the curl -Is command. The curl request returns the HTTP/ OK status code. VMware, Inc. 27

28 Procedure 1 For Ubuntu systems: a Obtain and import the VMware packaging public keys using the following commands. curl -L -- output VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub sudo apt-key add VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub b Create a file named appdefense.list under /etc/apt/sources.list.d. Note The Linux VM, where you want to deploy, must have netfilter dependency installed. If not, the VM must have access to the OS repository to install the netfilter package. c Create or edit /etc/apt/sources.list.d/appdefense.list with the following content. deb [arch=amd64] trusty main deb [arch=amd64] trusty main d Install the Guest Module package using the following commands. sudo apt-get update sudo apt-get install vmw-glx Note To upgrade or install a specific version, run the following command. sudo apt-get install vmw-glx=<version> 2 For RHEL systems: a Obtain and import the VMware packaging public keys using the following commands. wget rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub b Create a file named appdefense.repo under /etc/yum.repos.d. VMware, Inc. 28

29 c Edit the /etc/yum.repos.d/appdefense.repo file with the following content. [repo-appdefense] name= repo baseurl= enabled=1 gpgcheck=1 [guest-introspection-for-vmware-nsx] name=guest Introspection for VMware NSX baseurl= enabled=1 gpgcheck=1 d Install the Guest Module package using the following command. yum install vmw-glx Note To upgrade or install a specific version, run the following command: yum install vmw-glx-<version> 3 For CentOS systems: a Obtain and import the VMware packaging public keys using the following commands. wget rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub b Create a file named appdefense.repo under /etc/yum.repos.d. VMware, Inc. 29

30 c Edit the /etc/yum.repos.d/appdefense.repo file with the following content. [repo-appdefense] name= repo baseurl= enabled=1 gpgcheck=1 [guest-introspection-for-vmware-nsx] name=guest Introspection for VMware NSX baseurl= enabled=1 gpgcheck=1 d Install the Guest Module package using the following command. yum install vmw-glx Note To upgrade or install a specific version, run the following command. yum install vmw-glx-<version> 4 For SLES systems: a Obtain and import the VMware packaging public keys using the following commands. wget rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub b Add the following repository: zypper ar " appdefense zypper ar " guest-introspection-for-vmware-nsx c Install the Guest Module package using the following command. zypper install vmw-glx Note To upgrade or install a specific version, run the following command. zypper install vmw-glx-<version> VMware, Inc. 30

31 5 To verify if Guest Module is installed, run the following command with the root privilege. /etc/init.d/vmw_glxd status 6 To verify if the Guest Introspection is installed, run the following command with the root privilege. /etc/init.d/vmw_conn_notifyd status The status is running. What to do next If you cannot access the VMware package repository ( then install Guest Module on guest Linux virtual machines (VM) using the Downloads ( repository. Install Guest Module on Linux System Using the Downloads Repository If you cannot access the VMware package repository ( or you cannot access the operating system (OS) repository to install the netfilter dependencies, then you can install Guest Module on guest Linux virtual machines (VM) using the Downloads (appddl.vmware.com) repository. The installation of Guest Module installs the package, Guest Introspection package, and the netfilter dependencies. Perform the steps as applicable for your Linux distribution. Prerequisites You must complete the prerequisites before the actual installation. For details, refer to Guest Module Install Prerequisites for Linux Systems. The Linux VM (or server that is used to supply binaries to VMs) must have access to Procedure 1 For Ubuntu systems: a Obtain and import the VMware packaging public keys using the following commands. curl -L -- output VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub sudo apt-key add VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub b Create a file named appdefense.list under /etc/apt/sources.list.d. VMware, Inc. 31

32 c Create or edit /etc/apt/sources.list.d/appdefense.list with the following content. For Ubuntu 14.04: deb [arch=amd64] trusty main deb [arch=amd64] trusty main deb [arch=amd64] trusty main -Or- For Ubuntu 16.04: deb [arch=amd64] xenial main deb [arch=amd64] trusty main deb [arch=amd64] trusty main d Install the Guest Module package using the following commands. sudo apt-get update sudo apt-get install vmw-glx Note To upgrade or install a specific version, run the following command: sudo apt-get install vmw-glx=<version> 2 For RHEL systems: a Obtain and import the VMware packaging public keys using the following commands. wget rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub b Create a file named appdefense.repo under /etc/yum.repos.d. VMware, Inc. 32

33 c Edit the /etc/yum.repos.d/appdefense.repo file with the following contents: [repo-appdefense] name= repo baseurl= enabled=1 gpgcheck=1 [guest-introspection-for-vmware-nsx] name=guest Introspection for VMware NSX baseurl= enabled=1 gpgcheck=1 d For RHEL 7.0, 7.3 or 7.4: To install a dependent component, add the following line in the appdefense.repo file created in the previous step c. === [guest-introspection-os-bundle] name=guest Introspection OS Bundle baseurl= enabled=1 gpgcheck=0 === Note The baseurl parameter is represented as The os_version can be RHEL 7.0, 7.3, or 7.4. e Install the Guest Module package using the following command. yum install vmw-glx Note To upgrade or install a specific version, run the following command. yum install vmw-glx-<version> VMware, Inc. 33

34 3 For CentOS systems: a Obtain and import the VMware packaging public keys using the following commands. wget rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub b c Create a file named appdefense.repo under /etc/yum.repos.d. Edit the /etc/yum.repos.d/appdefense.repo file with the following contents: [repo-appdefense] name= repo baseurl= enabled=1 gpgcheck=1 [guest-introspection-for-vmware-nsx] name=guest Introspection for VMware NSX baseurl= enabled=1 gpgcheck=1 d For CentOS 7.1, 7.2, 7.3, or 7.4: To install a dependent component, add the following line in the appdefense.repo file created in the previous step c. [guest-introspection-os-bundle] name=guest Introspection OS Bundle baseurl= enabled=1 gpgcheck=0 Note The baseurl parameter is represented as The os_version can be CentOS 7.1, 7.2, 7.3, or 7.4. e Install the Guest Module package using the following command. yum install vmw-glx Note To upgrade or install a specific version, run the following command: yum install vmw-glx-<version> VMware, Inc. 34

35 4 For SLES systems: a Obtain and import the VMware packaging public keys using the following commands. wget rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub b Add the following repository. zypper ar " appdefense zypper ar " guest-introspection-for-vmware-nsx c For SLES 11.4, 12.2, or 12.3: To install a dependent component, add the following line in the appdefense.repo file created in the previous step b. zypper ar " Note The baseurl parameter is represented as The os_version can be SLES 11.4, 12.2, or d Install the Guest Module package using the following command. zypper install vmw-glx Note To upgrade or install a specific version, run the following command. zypper install vmw-glx-<version> 5 To verify if Guest Module is installed, run the following command with the root privilege. /etc/init.d/vmw_glxd status 6 To verify if the Guest Introspection is installed, run the following command with the root privilege. /etc/init.d/vmw_conn_notifyd status The status is running. Install Guest Module on Linux System Using Local Download If you do not have Internet access, then you can download the complete installation package and then configure the Guest Module on the required guest Linux virtual machines (VM) pointing to the local repository. VMware, Inc. 35

36 Perform the steps as applicable for your Linux distribution. Prerequisites Linux installation You must complete the prerequisites before the actual installation. For details, refer to Guest Module Install Prerequisites for Linux Systems. Procedure 1 This step is a common step for any Linux distribution. Download and import the complete VMware package using the following URLs. Expand the repository using the unzip and untar command For Ubuntu systems: a Obtain and import the VMware packaging public keys using the following commands. curl -L file:/home/downloads/repository/appdefense/key/vmware-appd-packaging-gpg-rsa-key.pub sudo apt-key add VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub file is the path where you saved the downloaded files. b Create a file named appdefense.list under /etc/apt/sources.list.d. VMware, Inc. 36

37 c Create or edit /etc/sources.list/appdefense.list with the following contents. For Ubuntu 14.04: deb [arch=amd64] file:/home/downloads/guest-introspection-os-bundle/ubuntu trusty main deb [arch=amd64] file:/home/downloads/appdefense/latest/ubuntu trusty main deb [arch=amd64] file:/home/downloads/repository/guest-introspection-for-vmwarensx/latest/ubuntu trusty main -Or- For Ubuntu 16.04: deb [arch=amd64] file:/home/downloads/guest-introspection-os-bundle/ubuntu xenial main deb [arch=amd64] file:/home/downloads/appdefense/latest/ubuntu trusty main deb [arch=amd64] file:/home/downloads/guest-introspection-for-vmware-nsx/latest/ubuntu trusty main d Install the Guest Module package using the following commands. sudo apt-get update sudo apt-get install vmw-glx Note To upgrade or install a specific version, run the following command: sudo apt-get install vmw-glx=<version> 3 For RHEL systems: a Obtain and import the VMware packaging public keys using the following commands. wget file:/home/downloads/appdefense/key/vmware-appd-packaging-gpg-rsa-key.pub rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub file is the path where you saved the downloaded files. b Create a file named appdefense.repo under /etc/yum.repos.d. VMware, Inc. 37

38 c Edit the /etc/yum.repos.d/appdefense.repo file with the following contents: [repo-appdefense] name= repo baseurl=file:/home/downloads/appdefense/latest/ enabled=1 gpgcheck=1 [guest-introspection-for-vmware-nsx] name=guest Introspection for VMware NSX baseurl=file:/home/downloads/guest-introspection-for-vmware-nsx/latest/rhel/x86_64/ enabled=1 gpgcheck=1 d For RHEL 7.0, 7.3 or 7.4: To install a dependent component, add the following line in the appdefense.repo file created in the previous step c. [guest-introspection-os-bundle] name=guest Introspection OS Bundle baseurl= file:/home/downloads/guest-introspection-os-bundle/rhel/7.0/ enabled=1 gpgcheck=0 Note The baseurl parameter is represented as file:/home/downloads/guest-introspection-osbundle/rhel/<os_version>. The os_version can be RHEL 7.0, 7.3, or 7.4. e Install the Guest Module package using the following command. yum install vmw-glx Note To upgrade or install a specific version, run the following command: yum install vmw-glx-<version> VMware, Inc. 38

39 4 For CentOS systems: a Obtain and import the VMware packaging public keys using the following commands. wget file:/home/downloads/appdefense/key/vmware-appd-packaging-gpg-rsa-key.pub rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub file is the path where you saved the downloaded files. b c Create a file named appdefense.repo under /etc/yum.repos.d. Edit the /etc/yum.repos.d/appdefense.repo file with the following contents: [repo-appdefense] name= repo baseurl=file:/home/downloads/appdefense/latest/ enabled=1 gpgcheck=1 [guest-introspection-for-vmware-nsx] name=guest Introspection for VMware NSX baseurl=file:/home/downloads/guest-introspection-for-vmware-nsx/latest/centos/x86_64/ enabled=1 gpgcheck=1 VMware, Inc. 39

40 d For CentOS 7.1, 7.2, 7.3, or 7.4: To install a dependent component, add the following line in the appdefense.repo file created in the previous step c. [guest-introspection-os-bundle] name=guest Introspection OS Bundle baseurl= file:/home/downloads/guest-introspection-os-bundle/centos/7.1/ enabled=1 gpgcheck=0 Note The baseurl parameter is represented as file:/home/downloads/guest-introspection-osbundle/centos/<os_version>. The os_version can be CentOS 7.1, 7.2, 7.3, or 7.4. e Install the Guest Module package using the following command. yum install vmw-glx Note To upgrade or install a specific version, run the following command: yum install vmw-glx-<version> 5 For SLES systems: a Obtain and import the VMware packaging public keys using the following commands. wget file:/home/downloads/appdefense/key/vmware-appd-packaging-gpg-rsa-key.pub rpm --import VMWARE-APPD-PACKAGING-GPG-RSA-KEY.pub file is the path where you saved the downloaded files. b Add the following repository. zypper ar "file:/home/downloads/appdefense/latest/" appdefense zypper ar "file:/home/downloads/guest-intappdefense.reporospection-for-vmwarensx/latest/sles/x86_64/" guest-introspection-for-vmware-nsx file is the path where you saved the downloaded files. VMware, Inc. 40

41 c For SLES 11.4, 12.2, or 12.3: To install a dependent component, add the following line in the appdefense.repo file created in the previous step b. zypper ar "file:/home/downloads/guest-introspection-os-bundle/sles/11.4/" Note The baseurl parameter is represented as file:/home/downloads/guest-introspection-osbundle/sles/<os_version>. The os_version can be SLES 11.4, 12.2, or d Install the Guest Module package using the following command. zypper install vmw-glx Note To upgrade or install a specific version, run the following command. zypper install vmw-glx-<version> 6 To verify if Guest Module is installed, run the following command with the root privilege. /etc/init.d/vmw_glxd status 7 To verify if the Guest Introspection is installed, run the following command with the root privilege. /etc/init.d/vmw_conn_notifyd status The status is running. Install Guest Module Using Package Manager Command If you do not want to configure the repository, you can use this method to install Guest Module on guest Linux virtual machines (VM) where your application workloads are running. The installation of Guest Module installs the package, and the Guest Introspection package. You must complete the prerequisites before the actual installation. For details, refer to Guest Module Install Prerequisites for Linux Systems. The Linux VM (or server that is used to supply binaries to VMs) must have access to To verify accessibility to packages.vmware.com, use the ping packages.vmware.com command. Then run the curl -Is command. The curl request returns the HTTP/ OK status code. Perform the steps as applicable for your Linux distribution. 1 Go to the Linux VM. 2 Go to the link provided in the table and download the Guest Introspection and packages for the relevant Linux distribution. VMware, Inc. 41

42 3 To install Guest Introspection and Guest Module, run the commands for the appropriate Linux distribution in the Command to Download Package column. Replace xxxx with the correct package string. For example, Guest-Introspection-for-VMware- NSX ubuntu_x86_64.deb and vmw-glx_ _amd64.deb. Table 2 1. Linux Package and Command to Use for Installation Linux Distribution Link to Download Package Command to Use for Installation Ubuntu NSX-x.x.x.x-xxxxxx-x.ubuntu_x86_64.deb e/latest/ubuntu/dists/trusty/main/binaryamd64/vmw-glx_x.x.x.xxxxxxx_amd64.deb dpkg i Guest- Introspection-for -VMware-NSX-x.x.x.xxxxxxxx.ubuntu_x86_64.deb dpkg i vmwglx_x.x.x.xxxxxxx_amd64.deb SLES Introspection-for-VMware-NSX-x.x.x.xxxxxxx-x.sles.x86_64.rpm e/latest/vmw-glx-x.x.x.xxxxxxx.x86_64.rpm rpm -Uvh Guest- Introspection-for- VMware-NSX-x.x.x.xxxxxxxx.sles.x86_64.rpm rpm Uvh vmw-glxx.x.x.xxxxxxx.x86_64.rpm RHEL e/latest/vmw-glx-x.x.x.xxxxxxx.x86_64.rpm rpm -Uvh Guest- Introspection-for- VMware-NSX-x.x.x.xxxxxxxx.rhel.x86_64.rpm rpm Uvh vmw-glxx.x.x.xxxxxxx.x86_64.rpm CentOS Introspection-for-VMware-NSX-x.x.x.xxxxxxx-x.centos.x86_64.rpm e/latest/vmw-glx-x.x.x.xxxxxxx.x86_64.rpm rpm -Uvh Guest- Introspection-for- VMware-NSX-x.x.x.xxxxxxxx.centos.x86_64.rpm rpm Uvh vmw-glxx.x.x.xxxxxxx.x86_64.rpm 4 To verify if Guest Module is installed, run the following command with the root privilege: /etc/init.d/vmw_glxd status VMware, Inc. 42

43 5 To verify if the Guest Introspection is installed, run the following command with the root privilege: /etc/init.d/vmw_conn_notifyd status The status is running. After Installation After registering the Appliance with vcenter Server, installing the Host Module on the ESXi host, and Guest Module on VMs where your application workloads are running, you can start using plug-in in the vsphere Client to monitor processes that are running on your applications. If you want to debug over a secure channel, you can encrypt the Java Management Extension (JMX) debugging offered by Appliance. For more information, refer to How to Secure JMX Communications. The Dashboard in the vsphere Client shows summary of the hosts and VMs where is installed. Dashboard displays overall processes based on the security risk detected by. engine monitors data and displays the process reputation. If you have subscribed to the Service (SaaS), you can navigate to the Manager from the plug-in in the vsphere Client. You can add the VMs that you want to monitor by to a scope and service, learn behaviors, and then protect the application by taking appropriate remediation action from the Manager. For more information, see Getting Started. VMware, Inc. 43

44 Using Appliance 3 You can view the overall status of the Appliance using the Appliance Dashboard. You can also register to vcenter Server, configure overall upgrade strategy, can collect troubleshooting logs and so on. 1 Log in to the Appliance VA GUI at ip address> using the admin credentials or using the vsphere user credentials. You can log in using the vsphere user credentials only when the Appliance is registered to the vcenter Server. The Appliance Dashboard appears as a default home page. By default, the Appliance time zone is UTC and cannot be changed. Appliance Dashboard Appliance Dashboard displays details about the Appliance performance indicators like CPU, memory, storage, and network details. To view the detailed health status of each service that is running on the Appliance, click Service Wise Status. The health status of the service is indicated with the following colors: Green: Service is installed and up. Red: Service is installed, but down. You can navigate to the Troubleshooting tab, and collect logs for the service which is down. VMware, Inc. 44

45 Table 3 1. Appliance Services Service Appliance management Description Manages overall functions of the Appliance like, CPU, memory, and storage details. Network information. Read or update the TLS certificates. Time details. Appliance upgrade. Export logs and view metrics. Cloud management Install upgrade management User interface vcenter management Alarm management Gateway server Manages connectivity with the Manager. Manages to install and upgrade bundles for plugin, Host Module, and Guest Module. Also manages upgrade bundles for Appliance. Manages Appliance and plug-in user interface. Manages connectivity and all interactions with the vcenter Server and NSX. Manages the behaviors reported by the Host Module on the Dashboard and VM Monitor tab in the vsphere Client. Gateway is the DMZ (demilitarized zone) service present in the Appliance. It is a gatekeeper which authenticates all the inbound connections to the Appliance services and forward it to the respective services for processing. VMware, Inc. 45

46 Table 3 1. Appliance Services (Continued) Service Provisioning management User management Description Manages integration with the provisioning systems like Puppet and Ansible. Manages the authentication, authorization, and access control for a user. Appliance Tabs You can configure the Appliance using tabs under the Configuration section. Tabs Registration General Upgrade Network Provisioning tools Description Use the Registration tab to register Appliance with vcenter Server, and NSX. You can select the required connectivity mode with Manager, and configure the vcenter SSO lookup service. Use the General tab to configure the NTP settings to synchronize time with the vcenter Server. For details, refer to Configure NTP Server Settings. You can also enable the FIPS mode and select the check boxes for the required TLS protocol version for the server and the client. When you enable the FIPS mode, any secure communication to or from the Appliance uses a cryptographic algorithm and protocols that are allowed by the United States Federal Information Processing Standards (FIPS). Use the Upgrade tab to define your overall upgrade strategy. For details, refer to the Upgrade section. Use the Network details tab to view your network settings. Use the Proxy tab to add or edit your proxy server details. The Provisioning tools tab is applicable only for the Service (SaaS) connectivity mode. Use the Puppet tab to configure Puppet with. Use the Ansible tab to configure Ansible with. Troubleshoot Use the Troubleshoot tab to search logs, change the log level settings, exporting different logs to troubleshoot any problem. For details, refer to Monitoring and Searching Logs With Appliance. This chapter includes the following topics: Appliance Connectivity Modes Configure NTP Server Settings Log In to Appliance With Certificate VMware, Inc. 46

47 Appliance Connectivity Modes The Appliance has three connectivity modes: Online, Offline, and SaaS to meet your compliance requirements. You must select the correct mode while working with plug-in. You can select the required connectivity mode while registering Appliance with vcenter Server. Connectivity Mode Offline Online SaaS Description Available only with the Platinum edition. Offline mode configures the Appliance to operate locally (no Internet connectivity). Process and network visibility is available in this configuration. Available only with the Platinum edition. In the Online mode, like Offline mode, all application behavior is stored in the data center. However, Online mode enables to download security feeds from the Service. These feeds deliver additional visibility and security context to process and network behavior. Also, new versions of the software can be downloaded from an external upgrade portal. Available with a SaaS subscription (included in the Platinum edition). SaaS mode enables the complete feature set. SaaS features include: Scope/service assignments Behavior analysis with Machine Learning Alarms and alarm classification Custom remediations Application topology maps Third-party integrations and more You can access to this functionality through Manager by subscribing to the Service (SaaS). For details, refer to Getting Started. Online Mode Online mode stores all data on-premises, but enables the retrieval of reputation feeds from the Service. Online mode enables a subset of features, including trust and threat scores for processes in the plug-in and virtual machine monitoring pages. Online mode is the default mode for the plug-in. VMware, Inc. 47

48 Manager Cloud On-premises vsphere Workloads Outbound-only, no configuration 3 Guest OS Guest Module Guest OS Guest Module Guest OS Guest Module Plug-in vcenter Server 1 Appliance 2 Host Module vsphere Host If you have an Internet connection, but no subscription to the Service (SaaS), you can use the Online mode. Online mode gathers all the required data from the cloud, and displays the reputation scores on the configured plug-in in the vsphere Client. When you have installed plug-in, you can view analysis of processes in the Dashboard from the vsphere Client. SaaS Mode SaaS mode is available with the SaaS subscription (included in the Platinum edition). SaaS mode enables the complete feature set. Manager Cloud On-premises vsphere Workloads Full SaaS configuration 3 Guest OS Guest Module Guest OS Guest Module Guest OS Guest Module Plug-in vcenter Server 1 Appliance 2 Host Module vsphere Host SaaS features include: Scope/service assignments VMware, Inc. 48

49 Behavior analysis with Machine Learning Alarms and alarm classification Custom remediations Application topology maps Third-party integrations and more You can access this functionality through the Manager by subscribing to the Service (SaaS). For details, refer to Getting Started. When you have installed plug-in, SaaS mode gathers all the required data from the cloud and displays that data on the configured plug-in in the vsphere Client. You can view analysis of processes in the Dashboard from the vsphere Client. You can go to the Manager from the Dashboard in the vsphere Client. You can then create a scope and take the remediation action from the Manager. Offline Mode You can use the offline mode without Internet connectivity. Offline mode provides process and network visibility. On-premises vsphere Workloads 3 Guest OS Guest Module Guest OS Guest Module Guest OS Guest Module Plug-in vcenter Server 1 Appliance 2 Host Module vsphere Host When you have installed plug-in, you can view analysis of processes on the Dashboard. Status of all the processes is displayed as unverified from the vsphere Client. Configure NTP Server Settings You must configure the NTP server to synchronize the SSO server time and Appliance time. Prerequisites You have deployed the Appliance. VMware, Inc. 49

50 Procedure 1 Log in to the Appliance VA GUI at ip address> using the admin credentials or using the vsphere user credentials. You can log in using the vsphere user credentials only when the Appliance is registered to the vcenter Server. 2 (If needed) Click Cancel to the self-signed certificate. 3 You must configure the time synchronization settings with the vcenter Server. Click the Configuration > General tab. 4 In the Time Settings section, click Edit. Note Time difference between the Appliance and the vcenter Server results in an clock skew error. Time Settings NTP server Fallback NTP server Date and Time Description A Network Time Protocol (NTP) server is used for synchronizing the time. Use the same NTP server that is used to set up the vcenter Server configuration. You must enter a comma-separated list of IP addresses or host names of the NTP servers. Enter details for an alternative NTP server. Verify if the date and time is synchronized with the vcenter Server. 5 Click Save. The NTP server setting is configured. Log In to Appliance With Certificate You can log in to the Appliance using a self-signed or a CA certificate. If the certificate is signed by the Certificate Authority (CA), then you must skip step 1 and 2 in the following procedure. VMware, Inc. 50

51 Procedure 1 Log in to Appliance with Secure Shell (SSH), and create a public-private key pair using OpenSSL with openssl genrsa -aes256 -out <private_key>.pem Enter a password when prompted. 2 Convert the key pair to PEM certificate with openssl req -new -x509 -key <private_key>.pem -out <public_cert>.cer. Provide values for the following parameters. Country Name (two letter code) [AU]: State or Province Name(full name) [Some-State]: Locality Name(example, city) : Organization Name(example, company) : Organizational Unit Name (example, section) : Common Name (example, server FQDN, or YOUR name) : 3 Use the keytool command to import the certificate in the Appliance TrustStore. keytool -importcert -file <public_cert>.cer -keystore "/opt/vmware/appdefense/etc/appd-appliancetruststore.jks" -storepass <store_password>... Trust this certificate? [no]: yes Certificate was added to keystore Go to the file at /opt/vmware/appdefense/gateway-server/config/application.yml to obtain the <store_password>. If necessary, use the super user or sudo credentials to access the file. Look for trust-store-password in the yaml file. 4 Create the PKS12/.pfx file using openssl pkcs12 -export -out <cert_name>.pfx -inkey <private_key>.pem -in <public_cert>.cer. 5 Import the created PKS12/.pfx to the guest operating system from where you want to access the Appliance using the certificate. 6 Open a Web browser, and navigate to Appliance GUI at ip address> and press Enter. The Select a certificate window appears. It displays the list of certificates that you can select. 7 Select the certificate that was imported to the Appliance TrustStore, and press OK. After the authentication is successful, you can log in to Appliance without the need to enter the user credentials. You can log in to Appliance with self-signed or a CA certificate, without the need to enter the user credentials. VMware, Inc. 51

52 Using Plug-In 4 After you have installed plug-in, you can access from vsphere Client. The ( ) icon appears in the left navigation pane and in the Shortcuts menu of the vsphere Client. This chapter includes the following topics: Using the Dashboard Using In vsphere Client Using the Dashboard To view the Dashboard page, click the ( ) icon. Dashboard Panels Online Trust Analysis Connected Hosts Description Helps in the analysis of the processes to display the reputation for all the processes that are monitored by. The status is displayed as: Connected: If status is connected, online trust analysis collects reputation from the Internet. Available for online and SaaS connectivity mode. Disconnected: Offline mode displays disconnected status. Displays connection status with the Manager when your connectivity mode is SaaS. Hosts status can be: Connected Disconnected Unsupported Note When there is some change in the state of the host, it takes up to five minutes for the actual health status to appear on the Dashboard. When a host is placed in the standby mode, the host status becomes Disconnected and the Re-Install button appears. Verify that the host is not in the standby mode before clicking the Re-install button. VMware, Inc. 52

53 Dashboard Panels Virtual Machines Description VM status can be: Unsupported Installed Needs Upgrade Risk Vetted Processes Risk can be high, medium, low, or unverified. Unverified risk means either is not connected to the Manager, or cannot identify risk of the process. To view the filtered view of the processes, click the risk. To navigate to the Manager, click Go to Manager. Low Reputation Processes Lists all the processes that are identified as high risk. To list of all processes and their details, click View all. You can filter by Reputation, Process name, or number of instances. To view the details in the Instances by Virtual Machine panel at the bottom of the page, click the process. To go back to the Dashboard page, click Dashboard. Using In vsphere Client You can access information in the vsphere Client from the hosts on which you have installed the Host Module, and VMs where you have installed Guest Module. vsphere Client Menu vsphere Client Tab Description Hosts and Clusters > Click the required host. Hosts and Clusters > Click the required host. VMs and Templates > Click the required VM. Summary Configure > > Security Summary The panel appears on the Summary tab. You can view details like install status, version number, VMs having installed, and overall health status. You can install or upgrade Host Module from this page. The > Security page displays the connection status. You can install or upgrade Host Module from this page. The panel appears on the Summary tab of any virtual machine in the vcenter Server inventory. You can install, upgrade, or view details about the Guest Module from the panel. VMware, Inc. 53

54 vsphere Client Menu vsphere Client Tab Description VMs and Templates > Click the required VM. VMs and Templates > Click the required VM. Monitor > > Security Configure > > Security The > Security page displays list of the processes that are monitored by on that particular VM. The process reputation is not displayed for the offline connectivity mode. To view the details, click the name of the process. The Outbound Connection and Inbound Connection tabs displays further details. To come back to the process list page, click Back To Processes. If your connectivity mode is SaaS, and you have Service (SaaS) subscription, to navigate to the login page of the Manager, click the Open link. For details on how to subscribe to SaaS, refer to Getting Started. The > Security page displays the connection status. You can install or upgrade Guest Module from this page. VMware, Inc. 54

55 Upgrading Plug-In 5 You can define your upgrade strategy using Appliance Upgrade tab. You must first upgrade the Appliance, then Host Module, and then Guest Module. The upgrade bundle is a zip file that contains required files to upgrade the necessary components of. You must upgrade in the following sequence: 1 Appliance 2 Host Module 3 Guest Module After the Appliance upgrades and the services are up and running, Plug-In is upgraded. Appliance and all services in the Appliance has a different version from the Host Module and Guest Module. For example, Appliance has a version and Host Module and Guest Module has a version Host module and guest module can have a maximum difference of one major version. When a host module and a guest module have versions more than one major version apart, upgrade the necessary component to match the version. If you upgrade vsphere, continues to work normally. You can download the upgrade bundles based on the configured connectivity mode. VMware, Inc. 55

56 Connectivity Mode Offline Online Upgrade For offline mode, you must download the upgrade bundle that is available at VMware website Plug-In is listed under Datacenter & Cloud Infrastructure > VMware vsphere > Platinum. For details, refer to Overall Upgrade Process. For online mode, you can receive upgrade bundles by the following ways: You can download the upgrade bundle that is available at VMware website SaaS For SaaS mode, you can receive upgrade bundles by the following ways: You can download the upgrade bundle that is available at VMware website -OR- You can automatically receive the upgrade bundle from the Appliance. You can upgrade based on your upgrade strategy that is configured from the Appliance. You can use the Auto Upgrade feature to upgrade automatically as per your upgrade strategy configured in the Appliance. -OR- Receive upgrade bundles for all three components automatically from the Appliance. Upgrade based on your upgrade strategy that is configured from the Appliance. -OR- Receive upgrade bundles for the Host Module and Guest Module from the Manager. Upgrade based on your upgrade strategy that is configured from the Appliance. -OR- Upgrade Host Module and Guest Module from Manager. This chapter includes the following topics: Configure Upgrade Strategy Overall Upgrade Process VMware, Inc. 56

57 Configure Upgrade Strategy You can define your upgrade strategy using Appliance > Upgrade tab. Upgrade strategy consists of selecting your preferred method to download the upgrade bundles and how to initiate the upgrade process. Procedure 1 Log in to the Appliance VA GUI at ip address> using the admin credentials or using the vsphere user credentials. 2 Go to the Configuration > Upgrade tab. 3 In the Bundle download strategy section, click Edit and select the strategy for receiving the upgrade bundle. Parameter Auto Detect and download Schedule frequency for downloading bundle Description If you want the Appliance to detect the available upgrade bundle automatically and download the file, select the Auto Detect and download check box. This option is applicable only for the online and SaaS connectivity mode. For offline mode, download the upgrade bundle that is available at VMware website Schedule frequency for downloading the upgrade bundle. VMware, Inc. 57

58 Parameter Download Now Upload FIle Description If you want to download the available upgrade bundle immediately, click Download Now. For the offline mode, you can upload the downloaded bundle as follows. 1 Click Choose File and select the downloaded ZIP file. 2 Click Upload. The upload progress bar displays the progress of the process. Wait until the upload is complete. The New Upgrade Available section becomes available with the Upgrade Now option at the end of the page. 4 In the Appliance upgrade strategy section, select the strategy for installing the downloaded bundles of the Appliance. Parameter Turn off Auto Upgrade Auto Upgrade Description If you do not want to upgrade automatically to a newer version when the upgrade bundles are available, select the Turn off Auto Upgrade option. If you want to upgrade to a newer version automatically, when the upgrade bundles are available, select the Auto Upgrade option. Note Schedule is set in the Appliance time zone. By default, the Appliance time zone is UTC and cannot be changed. VMware, Inc. 58

59 Parameter Schedule once Description If you want to schedule the upgrade by specifying date and time from the calendar, select the Schedule once option. Note Schedule is set as per the local (browser) time zone, and not as per the Appliance time zone. Schedule repeating If you want to repeat the upgrade schedule, either everyday or once in a week, select the Schedule repeating option. 5 In the VM Upgrade source section, select the strategy for receiving the upgrade bundle for Host Module and Guest Module. Parameter From Cloud Locally from Appliance Specify a repository Description If you have subscribed to the Service (SaaS), you can directly receive the upgrade bundle for Host Module and Guest Module from cloud. You can receive the upgrade bundle for Host Module and Guest Module from the Appliance bundle. You can upload the upgrade bundle to a repository, and can specify that repository to receive upgrade bundles for Host Module and Guest Module. Enter URL for the repository. Enter credentials for the repository. 6 To save your upgrade strategy, click Save. Upgrade initiates based on your saved upgrade settings. 7 The New Upgrade Available section becomes available when the new upgrade bundle is downloaded. If you want to upgrade immediately using the available upgrade bundle, click Upgrade Now. The Appliance restarts all the services. When the upgrade is in-progress, Appliance becomes unreachable for some time until the upgrade is complete. What to do next Go to Host Module and Guest Module and upgrade. Overall Upgrade Process You must follow the upgrade sequence. You must upgrade in the following sequence: 1 Appliance 2 Host Module VMware, Inc. 59

60 3 Guest Module Procedure 1 Log in to the Appliance VA GUI at ip address> using the admin credentials or using the vsphere user credentials. a b Download the upgrade bundle based on your upgrade strategy. For details, refer to Configure Upgrade Strategy. Upgrade Appliance. 2 Log in to the vsphere Client. a b Upgrade Host Module. Upgrade Guest Module. Appliance, Host Module, and Guest Module is upgraded. Upgrade Appliance The first step in the upgrade process is the Appliance upgrade. Prerequisites A new upgrade bundle is available. Procedure 1 Log in to the Appliance VA GUI at ip address> using the admin credentials or using the vsphere user credentials. 2 Appliance upgrades based on your configured Appliance upgrade strategy. For details, refer to Configure Upgrade Strategy. If you have selected Auto Detect and download to download the upgrade bundle and Auto Upgrade, the upgrade starts automatically when the upgrade bundle is available. If you have selected upgrade later by specifying date and time, the upgrade starts on the specified date and time. If you have selected Turn off Auto Upgrade and the upgrade bundle is available, click Upgrade Now to start the upgrade process manually. When the upgrade is in-progress, Appliance restarts all the services. Appliance remains unreachable during this time. After the upgrade is complete, you can verify the Appliance version on the Appliance Dashboard page. What to do next Upgrade Host Module. VMware, Inc. 60

61 Upgrade Host Module The second step in the upgrade process is to upgrade the Host Module. If you have subscribed to the Service (SaaS), you can upgrade the host module from the Manager as well. For details, refer to Installing. Prerequisites A new upgrade bundle is available based on your configured upgrade strategy. For details, refer to Configure Upgrade Strategy. Procedure 1 Log in to the vsphere Client. 2 Go to the host where you want to upgrade, and on the Summary tab, scroll down to the panel. If necessary, expand the panel. You can also use the Configure > > Security tab. 3 Click Upgrade. A new task for the upgrade appears in the Recent Tasks pane. After the task is complete, the Host Module is upgraded and displays the latest version. Host Module upgraded and displays the latest version. What to do next Upgrade Guest Module. VMware, Inc. 61

62 Upgrade Guest Module The second step in the upgrade process is to upgrade the Guest Module. You can upgrade both Windows and Linux virtual machine (VM) having guest module installed. You can upgrade the Linux VM same as Windows VM. If you have subscribed to the Service (SaaS), you can upgrade the guest module from the Manager as well. For details, refer to Installing. Prerequisites A new upgrade bundle is available based on your configured upgrade strategy. For details, refer to Configure Upgrade Strategy. Procedure 1 Log in to the vsphere Client. 2 Go to the guest VM (Windows or Linux) where you want to upgrade, and on the Summary tab, scroll down to the panel. If necessary, expand the panel. Alternatively, you can also use the Configure > > Security tab. 3 Click Upgrade. Note The Windows VM is rebooted during upgrade which can take five minutes. Linux VM is not rebooted. A new task for the upgrade appears in the Recent Tasks pane. After the task is complete, the Guest Module is upgraded and displays the latest version. Guest Module upgraded and displays the latest version. VMware, Inc. 62

63 Integrating With Other Products 6 You can optionally integrate with other provisioning systems such as NSX Data Center for vsphere and vrealize Automation. supports integration with partner security vendors, such as Splunk, IBM QRadar, Puppet, Cb Defense, Ansible, and Aqua Security. This feature is available only with SaaS mode. For more information, refer to Installing. VMware, Inc. 63

64 Uninstalling Plug-In 7 This chapter details the steps required to uninstall plug-in from your vcenter Server inventory. A complete uninstall of deletes the plug-in, Appliance, removes Host Module, and Guest Module. After the Appliance virtual machine is deleted, the plug-in is removed from vcenter Server. When the plug-in is uninstalled, the behavior monitoring functionality is no longer available on the vcenter Server. If you have subscribed to the Service (SaaS), you can still log in to Manager. This chapter includes the following topics: Uninstall Appliance Uninstall Plug-In Uninstall the Host Module Uninstall the Guest Module Uninstall Appliance You can remove the earlier deployed Appliance virtual machine (VM) from the vcenter Server. Prerequisites Appliance VM is deployed. Procedure 1 Log in to the Appliance VA GUI at ip address> using the admin credentials or using the vsphere user credentials. 2 Go to the Configuration > Registration tab. 3 In the SSO lookup configuration section, click Edit. 4 In the vcenter Server details section, click Unregister. A confirmation dialog box appears. VMware, Inc. 64

65 5 To unregister, click OK. 6 Log in to the vsphere Client. 7 Power off the Appliance VM. 8 To permanently delete the Appliance VM from the datastore, right-click the Appliance VM. 9 Select Delete from Disk, and click OK. For details, refer to vsphere documentation. The Appliance VM is permanently deleted. What to do next Uninstall Host Module and Guest Module. Uninstall Plug-In You can uninstall the plug-in from the vcenter Server. After the plug-in is uninstalled, the behavior monitoring functionality will not be available in the vcenter Server. Prerequisites You have installed plug-in. Procedure 1 In a web browser, navigate to Where vcenter_server_name_or_ip/mob is the name or IP address of your vcenter Server from which you want to remove the plug-in. 2 Click Content. 3 Click ExtensionManager. VMware, Inc. 65

66 4 From the list of values under Properties, copy the name of the plug-in (com.vmware.appd.appliance.vsphere.plugin) that you want to remove. 5 Click UnregisterExtension. A new window appears. Paste the key of the plug-in and click Invoke Method. The plug-in is removed. 6 Close the window. 7 To verify that the plug-in is removed successfully, refresh the Managed Object Type: ManagedObjectReference: ExtensionManager window. 8 Restart the vsphere Web Client service. Secure Shell (SSH) to the vcenter Server, and restart the vsphere-ui service using the./vmon-cli -r vsphere-ui command. Note If you have vcenter Server in Linked Mode, you must reboot all vcenter Servers or reboot the vsphere-ui services running on those vcenter Servers to display that the plug-in is removed from all the vcenter Servers. 9 To confirm the uninstall, log out of vcenter Server and log back in. plug-in is removed from vcenter Server. The icon no longer appears on the Home screen in the vsphere Client. Go to Administration > Client Plug-Ins and verify that the list of plug-ins does not include plug-in. The plug-in is removed from vcenter Server. Uninstall the Host Module You can uninstall the earlier deployed Host Module. Uninstall of Host Module removes the glxhost VIBs from the ESXi host. VMware, Inc. 66