Arctic Wolf Appliances


vScanner Installation using Azure

Updated Feb 20, 2024

Install a vScanner using the Azure portal

As part of Arctic Wolf® Managed Risk, install a Virtual Scanner (vScanner) to perform continuous risk monitoring and vulnerability assessments. The vScanner provides context for vulnerabilities that you may have in your environment. Vulnerabilities that the vScanner discovers appear in the Risk Dashboard.

Before you begin

To use a single vScanner to access multiple virtual networks, enable vNet peering.

Steps

  1. Provide your Azure account information to Arctic Wolf.
  2. Create a vScanner instance.
  3. Configure the vScanner.
  4. Activate the vScanner.

Step 1: Provide your Azure account information to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.

  2. Click Telemetry Management > Connected Accounts.

  3. Click Add Account +.

  4. On the Add Account page, click Arctic Wolf Azure Appliance VM.

  5. On the Add Account page, configure these settings:

    • Account Name — Enter a unique and descriptive name for the account.
    • Choose Identification — Select one of these:
      • Tenant ID

        You can find your Tenant ID in your Azure account in the Tenant Properties section.

      • Subscription ID

        You can find your Subscription ID in your Azure account in the Subscriptions section.

    See Subscriptions, licenses, accounts, and tenants for Microsoft's cloud offerings - Microsoft 365 Enterprise for more information.

  6. Click Test and Submit Credentials.

    A message appears, indicating that the subscription confirmation was requested.

  7. Click Go back to the Connected Accounts page.

  8. Click Telemetry Management > Connected Accounts.

  9. Make sure that the Azure account is listed and that the status of the account is Config Pending.

    After your Concierge Security® Team (CST) enables security monitoring for this account, the connected account status changes to Healthy.

Note: It can take up to 24 hours for the vScanner appliance to become visible.

Step 2: Create a vScanner instance

  1. Sign in to Microsoft Azure.

  2. Click +Create a resource.

  3. In the search field, enter Arctic Wolf.

  4. In the My Marketplace section, click Private plans.

  5. Click AWN - Virtual Appliance.

  6. In the Plan list, select Arctic Wolf - Virtual Appliance.

  7. Click Create.

  8. In the Basics section, configure these settings:

    • Subscription — Create a new resource group or assign an existing resource group.

    • Instance details — For Virtual machine name, enter the virtual machine (VM) name.

    • Security type — Select Standard.

    • Size — Select Standard_D4as_v5 - 4 vcpus, 16 GiB memory.

  9. Click Next: Disks.

  10. In the Disks section, in the OS options > OS disk type section, select Standard SSD.

  11. Click Next: Networking.

  12. In the Networking section, configure these settings:

    • Virtual network — Select the virtual network.
    • Subnet — Select the subnet.
    • Public IP — Select None.
    • Public inbound ports — Select None.
  13. Click Review + create.

  14. Click Create.

  15. In the Generate a new key pair box, click Download private key and create resource.

    Note: The private key is not used by Arctic Wolf. You can delete it.

    After the private key is downloaded, Deployment is in progress displays.

  16. Click Go to resource.

Step 3: Configure the vScanner

  1. In the left navigation, click Serial console.

  2. When prompted, press Enter three times to start the serial console session.

  3. To start configuring vScanner, click Next.

  4. At the Use a proxy? prompt, select one of these options:

    • If your vScanner traffic needs to go through a proxy server, select Yes, and then configure these settings:

      • Server IP address — Enter the proxy server IP address for your appliance.
      • Server port — Enter the proxy server port.
    • Select No.

  5. At the Do you want to verify your network connection? prompt, select one of these options:

    • Yes

      A series of connectivity tests run.

    • No

  6. Click Next.

  7. At the Tell us about the application you are configuring prompt, configure these settings:

    • In the Shorthand field, enter the shorthand name for the vScanner.

    • Select Scanner.

  8. Click Next.

  9. When prompted, do one of these actions to connect the vScanner to the Arctic Wolf Platform:

    • On a mobile device — Scan the QR code displayed in the console window, and then follow the on-screen prompts.

      Note: QR codes expire after 15 minutes. A new code appears in the console if the QR code expires.

    • In a web browser — Enter the displayed URL into the URL field, and then follow the on-screen prompts.

    After the vScanner successfully connects to the Arctic Wolf Platform, a prompt replaces the QR code, asking you to sign in to the MDR Dashboard, and then click Accounts > Arctic Wolf Appliance Management.

Step 4: Activate the vScanner

Note: Only the user who completed Configure the vScanner can activate the vScanner.

  1. Sign in to the MDR Dashboard.

  2. Click Account > Arctic Wolf Appliance Management.

  3. Find the appliance that you want to activate.

  4. In the Actions column, click Activate <appliance>, and then click Activate <appliance> when prompted.

    The console displays Appliance activation in progress, please wait.

  5. When prompted, press Enter three times to activate the console.

See also