Install a vScanner using the AWS Management Console

As part of Arctic Wolf® Managed Risk, install a Virtual Scanner (vScanner) to perform continuous risk monitoring and vulnerability assessments. vScanner provides context for vulnerabilities that you may have in your environment.

Before you begin

• Make sure you have the appropriate Arctic Wolf permissions to complete the vScanner deployment. Contact your Concierge Security Team© (CST) to confirm who in your organization has these permissions.
• Add all necessary IP addresses, ports, and services to your allowlist for full vScanner functionality.

  Tip: To see the complete list of IP addresses that you must allowlist, go to the Arctic Wolf Unified Portal, and then click Help > Allowlist Requirements. The IP addresses that must be allowlisted are listed under Scanners.

• If you rate-limit the vScanner with Quality of Service (QoS), remove this for best performance.
• If your firewall provides SSL/TLS inspection, do not perform this inspection on the vScanner management IP address.
• If you are using an application proxy or layer 7 filter on your firewall, allow outbound traffic over OpenVPN for the vScanner management IP address.

Steps

1. Provide AWS account IDs to Arctic Wolf. 
2. Create a vScanner instance.
3. Configure network settings for the vScanner instance.
4. Configure security group rules for the vScanner instance.
5. Launch and verify the EC2 instance.
6. Configure the vScanner.
7. Activate the vScanner.

Step 1: Provide AWS account IDs to Arctic Wolf

For the vScanner Amazon Machine Image (AMI) to appear in AWS, you must first provide your AWS account IDs to Arctic Wolf.

1. Sign in to the Arctic Wolf Unified Portal.

2. In the menu bar, click Telemetry Management > Connected Accounts.

3. Click Add Account +.

4. On the Add Account page, from the Account Type list, select Cloud Detection and Response.

5. In the Search Services field, type appliance.

6. Click vSensor AMI.

7. On the Add Account page, configure these settings:

   1. Account Name — Enter a unique and descriptive name for the account.
   2. Account ID — Enter the AWS account number.

8. Click Test and Submit Credentials.

Step 2: Create a vScanner instance

1. In the Amazon Machine Images (AMI) section, in the AWS console, select the vScanner AMI to use to create the instance

   Note: The name of the AMI is Arctic Wolf Appliance-<version>.

2. Click Launch Instance from AMI.

3. In the Name and tags section, enter the name for your vScanner.

4. In the Application and OS Images (Amazon Machine Image) section, keep the default settings.

5. In the Key pair (login) section, select Proceed without a key pair.

6. In the Configure storage section, keep the default settings unless you require more storage.

7. In the Advanced details section, for Termination Protection, select the Enable checkbox.

8. Click Save.

9. In the Instance Type section, configure these settings for the type of vScanner you are installing:

   • AWNv200 scanner with 21GB memory — c5n.2xlarge
   • AWNv200 scanner with 64GB memory — r5.2xlarge

Step 3: Configure network settings for the vScanner instance

1. In the AWS console, in the Network settings section, click Edit, and then select one of these options:
   • VPC — The VPC to deploy the vScanner on.
   • Subnet — The subnet to deploy the vScanner on.

     Notes:

     • Whether you use a private or public subnet depends on your network. Arctic Wolf recommend using a private subnet.
     • Do not select No preference.
   • Auto-assign public IP — Select one of these options:
     • Enable
     • Disable — If you are using a private subnet, or if your environment requires you to enter a specific IP address.

Step 4: Configure security group rules for the vScanner instance

Depending on your environment, you may need to configure new security group rules to allow outgoing and incoming traffic for the vLC.

1. Find the Firewall (security groups) section.

2. Do one of these actions:

   • Using an existing security group — Click Select an existing security group, and then choose the appropriate security group and proceed to Launch and verify the EC2 instance.
   • Creating a new security group — Click Create a new security group.

3. Remove any default security rules.

4. In the Security group name section, enter a name for the security group.

5. In the Description section, enter a description for the security group.

6. Remove the default inbound security group rule.

7. Add a rule to allow all outgoing traffic, if it does not already exist.

Step 5: Launch and verify the EC2 instance

1. Click Launch Instance.
2. Click the instance ID, where the ID value is i-<hexadecimals>.
3. Click the instance ID to view details.

   Note: If the instance ID does not appear, refresh the page.

4. Verify that the Instance state is Running.

Step 6: Configure the vScanner

1. If you have not used the serial console before, you may need to configure access. To configure serial console access:

   1. Click Actions > Account Attributes.
   2. In the Account Attributes section, select EC2 Serial Console.
   3. In the EC2 Serial Console section, select the Allow checkbox.
   4. Click Update.

2. Locate the EC2 management console, select Instances, and then enter the vScanner instance ID.

3. Click Actions > Monitor and Troubleshoot > EC2 Serial Console > Connect.

4. When prompted, or if the screen is blank, press the Enter key three times.

   Note: If you selected an unsupported EC2 instance type, an error message displays after this step. To proceed, terminate the vSensor and create a new one using a supported EC2 instance type.

5. Click Next.

   A series of connectivity checks begin.

6. If any of the connectivity checks fail, modify the VPC, subnet, or security group as required, and then reattempt the connectivity checks.

7. When the connectivity check passes, click Next.

8. In the Shorthand section, enter a name for the vScanner in the Arctic Wolf Portal.

9. Select the Scanner deployment type.

10. Click Next.

Step 7: Activate the vScanner

1. In the Arctic Wolf Portal, click Account > Arctic Wolf Appliance Management.

2. Locate the name or the serial number of the vScanner you want to activate.

3. In the Actions column, click Activate virtual appliance, and then click Activate Virtual Network Appliance when prompted.

   The console displays Appliance activation in progress, please wait.

4. When prompted, press Enter three times to activate the console.

Next steps

• Schedule host identification and vulnerability scans. See Manage Risk Scanner configuration for more information.

Reconfigure a vScanner using the AWS Management Console

You cannot reconfigure a vScanner that was deployed using AWS. If you want a different configuration, delete the old vScanner and configure a new vScanner. See Uninstall a vScanner using the AWS Management Console for more information.

Uninstall a vScanner using the AWS Management Console

1. Decommission the vScanner:

   1. Sign in to the Arctic Wolf Portal.

   2. Click Account > Arctic Wolf Appliance Management.

   3. Find the short name or serial number of the vScanner you want to decommission.

   4. Under Actions, click Decomission virtual appliance, and then select Decommission Virtual Appliance when prompted.

2. Turn off termination protection:
   1. In the AWS web console, click to Instances.
   2. Click Actions > Instance Settings > Change termination protection.
   3. Clear the Enable checkbox.
   4. Click Save.
3. Delete the EC2 instance:

   1. In the AWS web console, click Instance state.

   2. Click Terminate Instance.

      The EC2 instance shuts down and the associated disk resources are removed.

See also

• Managed Risk Scanner Installation and Configuration Guide