vScanner Installation using the AWS Management Console

Updated Sep 20, 2023

Install a vScanner using the AWS Management Console

As part of Arctic Wolf® Managed Risk, install a Virtual Scanner (vScanner) to perform continuous risk monitoring and vulnerability assessments. vScanner provides context for vulnerabilities that you may have in your environment.

Notes:

  • vScanners do not support auto-scaling in Amazon Web Services®.
  • Amazon GuardDuty flags vScanners as containing malware because vScanners contain code that is used to detect vulnerabilities. To avoid this behavior, create a suppression rule to exclude the vScanner from Amazon GuardDuty® monitoring. See the AWS documentation for more information.

Before you begin

Steps

  1. Provide AWS account IDs to Arctic Wolf
  2. Create a vScanner instance.
  3. Configure network settings for the vScanner instance.
  4. Configure security group rules for the vScanner instance.
  5. Launch and verify the EC2 instance.
  6. Configure the vScanner.
  7. Activate the vScanner.

Step 1: Provide AWS account IDs to Arctic Wolf

For the vScanner Amazon Machine Image (AMI) to appear in AWS, you must first provide your AWS account IDs to Arctic Wolf.

  1. Sign in to the Arctic Wolf Unified Portal.

  2. In the menu bar, click Telemetry Management > Connected Accounts.

  3. Click Add Account +.

  4. On the Add Account page, from the Account Type list, select Cloud Detection and Response.

  5. In the Search Services field, type appliance.

  6. Click vSensor AMI.

  7. On the Add Account page, configure these settings:

    1. Account Name — Enter a unique and descriptive name for the account.
    2. Account ID — Enter the AWS account number.
  8. Click Test and Submit Credentials.

Note: It may take up to 24 hours before the vScanner AMI is visible.

Step 2: Create a vScanner instance

  1. In the Amazon Machine Images (AMI) section, in the AWS console, select the vScanner AMI to use to create the instance

    Note: The name of the AMI is Arctic Wolf Appliance-<version>.

  2. Click Launch Instance from AMI.

  3. In the Name and tags section, enter the name for your vScanner.

  4. In the Application and OS Images (Amazon Machine Image) section, keep the default settings.

  5. In the Key pair (login) section, select Proceed without a key pair.

  6. In the Configure storage section, keep the default settings unless you require more storage.

  7. In the Advanced details section, for Termination Protection, select the Enable checkbox.

  8. Click Save.

  9. In the Instance Type section, configure these settings for the type of vScanner you are installing:

    • AWNv200 scanner with 21GB memory — c5n.2xlarge
    • AWNv200 scanner with 64GB memory — r5.2xlarge

Step 3: Configure network settings for the vScanner instance

  1. In the AWS console, in the Network settings section, click Edit, and then select one of these options:
    • VPC — The VPC to deploy the vScanner on.
    • Subnet — The subnet to deploy the vScanner on.

      Notes:

      • Whether you use a private or public subnet depends on your network. Arctic Wolf recommend using a private subnet.
      • Do not select No preference.
    • Auto-assign public IP — Select one of these options:
      • Enable
      • Disable — If you are using a private subnet, or if your environment requires you to enter a specific IP address.

Step 4: Configure security group rules for the vScanner instance

Depending on your environment, you may need to configure new security group rules to allow outgoing and incoming traffic for the vLC.

Tip: Arctic Wolf recommends that you create a new security group to avoid having more permissions than necessary. However, you can use an existing security group if it has the required rules configured.

  1. Find the Firewall (security groups) section.

  2. Do one of these actions:

    • Using an existing security group — Click Select an existing security group, and then choose the appropriate security group and proceed to Launch and verify the EC2 instance.
    • Creating a new security group — Click Create a new security group.
  3. Remove any default security rules.

  4. In the Security group name section, enter a name for the security group.

  5. In the Description section, enter a description for the security group.

  6. Remove the default inbound security group rule.

  7. Add a rule to allow all outgoing traffic, if it does not already exist.

Step 5: Launch and verify the EC2 instance

  1. Click Launch Instance.
  2. Click the instance ID, where the ID value is i-<hexadecimals>.
  3. Click the instance ID to view details.

    Note: If the instance ID does not appear, refresh the page.

  4. Verify that the Instance state is Running.

Step 6: Configure the vScanner

Note: See the Serial Console User Guide for more information on using the Arctic Wolf serial console.

  1. If you have not used the serial console before, you may need to configure access. To configure serial console access:

    1. Click Actions > Account Attributes.
    2. In the Account Attributes section, select EC2 Serial Console.
    3. In the EC2 Serial Console section, select the Allow checkbox.
    4. Click Update.
  2. Locate the EC2 management console, select Instances, and then enter the vScanner instance ID.

  3. Click Actions > Monitor and Troubleshoot > EC2 Serial Console > Connect.

  4. When prompted, or if the screen is blank, press the Enter key three times.

    Note: If you selected an unsupported EC2 instance type, an error message displays after this step. To proceed, terminate the vSensor and create a new one using a supported EC2 instance type.

  5. Click Next.

    A series of connectivity checks begin.

  6. If any of the connectivity checks fail, modify the VPC, subnet, or security group as required, and then reattempt the connectivity checks.

  7. When the connectivity check passes, click Next.

  8. In the Shorthand section, enter a name for the vScanner in the Arctic Wolf Portal.

  9. Select the Scanner deployment type.

  10. Click Next.

Step 7: Activate the vScanner

Note: Only the user who performed the steps to configure the vScanner can activate the vScanner.

  1. In the Arctic Wolf Portal, click Account > Arctic Wolf Appliance Management.

  2. Locate the name or the serial number of the vScanner you want to activate.

  3. In the Actions column, click Activate virtual appliance, and then click Activate Virtual Network Appliance when prompted.

    The console displays Appliance activation in progress, please wait.

  4. When prompted, press Enter three times to activate the console.

Next steps

Reconfigure a vScanner using the AWS Management Console

You cannot reconfigure a vScanner that was deployed using AWS. If you want a different configuration, delete the old vScanner and configure a new vScanner. See Uninstall a vScanner using the AWS Management Console for more information.

Uninstall a vScanner using the AWS Management Console

  1. Decommission the vScanner:
    1. Sign in to the Arctic Wolf Portal.

    2. Click Account > Arctic Wolf Appliance Management.

    3. Find the short name or serial number of the vScanner you want to decommission.

    4. Under Actions, click Decomission virtual appliance, and then select Decommission Virtual Appliance when prompted.

  2. Turn off termination protection:
    1. In the AWS web console, click to Instances.
    2. Click Actions > Instance Settings > Change termination protection.
    3. Clear the Enable checkbox.
    4. Click Save.
  3. Delete the EC2 instance:
    1. In the AWS web console, click Instance state.

    2. Click Terminate Instance.

      The EC2 instance shuts down and the associated disk resources are removed.

See also