Probe Installation on VM

Remote vRule Engine Installation (Optional)

Follow these steps only if the vRule Engine must be installed remotely:

Pre-requisites

The remote vRule requirements are provided below:

1. Operating System: Red Hat Enterprise Linux Server 7.9
2. Min 8vCPUs
3. 8 GB RAM
4. Docker version – 18.x+
5. 100-200MB in /tmp partition during installation

Installation

1. Download the tar file vsp-web-remote-ae.tar.gz from the Artifactory directory
   1. Version 2.8 and Above : vsp > releases > public <Major_Release> > <Minor_Release> > <Patch_Version> > tar_package > remote_ae
      Example: vsp > releases > public > 2 > 2.8 > 2.8.0 > tar_package > remote_ae
   2. Version 2.7 : vsp > releases > public > <Release_Number> > tar_package > remote_ae
      Example: vsp > releases > public > 2.7.0 > tar_package > remote_ae
2. Execute the below commands:
   ShellShell

   tar -xvzf vsp-web-remote-ae.tar.gz
   ./vsp_run_vrule.sh -h  # To view the script usage
   ./vsp_run_vrule.sh

3. The various arguments accepted by vsp_run_vrule.sh script are:

   Parameter	Description
   -c <CMS_IP>	IP Address of the CMS
   -i <vRule_IP>	IP Address of the Remote vRule Host
   -k <Kafka_IP>	IP Address of the Kafka
   Optional Parameters
   -K <Custom_Advertised_Listener>	Provide this option if Kafka is configured with custom advertised listener
   -s	Provide this option to stop the Remote vRule container if running
   -u	Provide this option if CMS is deployed with custom certificates

4. Verification: Navigate to Deploy > Overview in the left navigation pane. The vRule Engine is listed with the status Connected

Install Probe

For VMs, utilize/create a deployment profile and add a Probe as described below:

Deployment Profiles

1. Deployment profiles contain environment-specific information required for Probe installation
2. To view the Deployment Profiles, log in to CMS and navigate to Deploy > Deployment Profiles
3. Out-of-the-box profiles are provided. New Deployment Profiles can be created if required
   1. Version 2.11 and Above: Three profiles are provided:
      1. Default Windows (2003) VM
      2. Default Linux VM
      3. Default Windows (Others) VM (Windows 2008 profile is merged with the common Windows Profile)
   2. Version 2.8 - 2.10: Four Profiles are provided. These profiles cannot be modified or deleted
   3. Version 2.7: Two Profiles are provided, one each for Linux and Windows
4. Each Profile contains configuration information required for Probe installation like IP Addresses, preferences related to  Uninstallation (in upgrade scenarios) 
5. Click on the required Profile to view more information
   1. Utilize Standard tab to configure the required parameters
   2. Utilize Advanced tab to configure the optional parameters
6. User-created profiles can be modified or deleted

Add new Probe

To procure the actual commands/instructions for Probe installation, follow the steps below:

Navigate to Deploy > Probes on CMS. Click ADD NEW

STEP 1: Select the required Deployment Profile

STEP 2:  Utilize the provided commands to download and untar (Linux only) the installable. Use the copy button to copy the command for both Windows and Linux

STEP 3:  Utilize the provided command to install VSP Probe

STEP 4: If Probe automatic restart is not configured, utilize the provided command for VSP services restart

Further Steps 

Web and Memory Protection

STEP 1: Applications are created automatically discovered in CMS. Click here for more information. In cases, manual Application Creation is preferred, click here

STEP 2: Secure the Probe on CMS

Host Protection

STEP 1: Configure Threat Intelligence Service

STEP 2: Create Host Profile

STEP 3: Associate Hosts to the newly created Profile