AlienVault® USM Anywhere™

Deploying the AWS Sensor

After you review the requirements and make sure that your AWS environment is configured as needed, you can deploy the AWS sensor. Using the CloudFormation Template provided by AT&T Cybersecurity, you automatically deploy USM Anywhere as a service into your environment.

The following procedure describes how to launch the AWS sensor when provisioning the USM Anywhere service for the first time. In this process, you launch the USM Anywhere product from the AWS console using the AWS CloudFormation template.

Important: If you are deploying the sensor in a VPC, make sure that the target VPC subnet has the Enable auto-assign public IPv4 address option enabled prior to creating the CloudFormation stack. For detailed information, refer to the AWS documentation.

To create a new sensor in the AWS console

  1. Under Management Tools, click CloudFormation.
  2. Click Create New Stack.

    Create a new CloudFormation stack in the AWS console

    This launches the AWS Create Stack wizard.

  3. On Select Template , scroll to the Choose a template section and select Specify an AWS S3 template URL.

    Specify an AWS S3 template URL option

  4. Copy and paste the URL for the USM Anywhere Sensor that fits your environment.

    • Amazon Virtual Private Cloud (VPC)

    • Classic mode of Amazon Elastic Compute Cloud (Amazon EC2)

  5. Click Next.
  6. On the Specify Details page, enter a name in the Stack name text box.

    The name must be one word. Use hyphens, if desired. For example, you could call the stack "USM-sensor-1".

  7. Set the Parameters.

    Note: The volume size should be prefilled. You can leave this setting at the default value.

    • In the USM Anywhere Sensor Name text box, enter a name for the Sensor. This is usually the same as the stack name.
    • In the Key Name list, select the key pair that you normally use for an ssh connection into AWS instances.
    • Specify the HTTP Access Range and SSH Access Range.

    Click Next when the stack details are complete.

  8. (VPC templates only) Select the appropriate VPC ID and Subnet ID, and then click Next.

  9. (Optional) On the Options page, set tags for the instance and click Next.

  1. On the Review page, select the check box at the bottom of the page, next to the statement:

    I acknowledge that AWS CloudFormation might create IAM resources.

    On the Review page, select the IAM resources acknowledgement

  2. Click Create.

  3. In the Create stack page, confirm that your newly created stack status reads:


    Stack creation typically takes about 15 minutes. When the stack build is complete, you see the following confirmation:


  4. After your new stack is complete, at the bottom of the Create Stack table, click the Outputs tab and locate the URL.

    Click the URL link (displayed in blue) to access the sensor VM instance

    This URL is based on the public IPv4IPv4 is the most commonly used Internet Protocol, despite the fairly limited number of IP addresses it can support (2^32). An IPv4 address is written as a series of four numbers separated by periods, for example, IPv6, the latest version of the Internet Protocol (IP), is notable in that it expanded the available address space to a length of 128 bits compared to 32 bits in IPv4. IPv6 addresses are represented as eight groups of four digits separated by colons address of your deployed Sensor (http://<ip-address>). Make note of this address so that you have it for configuring your data sources to send data to the Sensor.

    See the AWS documentation for more information about how it manages public IPv4 addresses.

  5. Click the URL link to launch the USM Anywhere Sensor Setup page.


See Setting the AWS Sensor Connection to USM Anywhere.