AlienVault® USM Anywhere™

Deploying the USM Anywhere Sensor from the Azure Marketplace

After you review the requirements and make sure that your Azure environment is configured as needed, you can deploy the Azure sensor. AT&T Cybersecurity provides the virtual machine (VM) template for the USM Anywhere Sensor and makes it available through the Azure Marketplace for easy deployment.

Note: Microsoft Azure limits the availability of the Azure Marketplace to customers according to country. On the Marketplace FAQs page, the "Azure Marketplace for Customers" section provides a current list of supported countries.

If the Azure Marketplace is not supported for your country, contact AlienVault Support for assistance with manually downloading the USM Anywhere Sensor and importing the image and template into your subscription.

To deploy a USM Anywhere Sensor from the Azure Marketplace

  1. Open the USM Anywhere Sensor page at

    If you are not already logged in to the Azure console, this launches the Microsoft Azure Login page. Provide your Azure account credentials (username and password) and click Sign in.

  2. On the page, review the details of the license and click Create.

    Review the license information and click Create

    This takes you to the Create Virtual Machine Basics page, which guides you through the steps for deploying the USM Anywhere Sensor VM.

  3. Specify the Basics for the virtual machine:

    • Name — Enter the name you want to use for the USM Anywhere Sensor virtual machine.
    • VM disk type — Select the disk type, HDD or SSD.
    • User name — Enter the SSHProgram to securely log into another computer over a network, to execute commands in a remote machine, and to move files from one machine to another through Secure Copy (SCP). username as sysadmin.

      Important: For access to the USM Anywhere CLI or anything that requires root access, this must be sysadmin. If you use another user name, the AlienVault Technical Support team cannot connect to the Sensor and provide diagnostic assistance.

      For more information about remote support for deployed Sensors, see Troubleshooting and Remote Sensor Support.

    • Authentication type — Set this option to specify an SSH Public key or a password for SSH access.
    • Subscription — Select the subscription into which USM Anywhere Sensor should be installed.
    • Resource Group — Indicate whether you want to install the USM Anywhere Sensor into an existing resource group or into a new resource group. If new, enter a unique name.
    • Location — If you are using a new resource group, indicate the region for the USM Anywhere Sensor. Otherwise, leave this as the default.

    Specify the basic attributes for the sensor VM

  4. Click OK.
  5. In the Choose a Size blade, select the instance size of your virtual machine.

    AT&T Cybersecurity recommends the following instance sizes:

    • HDD instances — D2 standard
    • SSD instances — DS2 standard

    Select a size for the sensor VM instance

  6. Click Select.
  7. In the Settings blade, define the storage and network preferences:

    • Storage Account — Set the storage account that the USM Anywhere Sensor should use.

      • If you select HDD as the disk type, this requests a new standard storage account by default.
      • If you select SSD as the disk type, this requests a new premium storage account by default.
    • Network — Set the network where the USM Anywhere Sensor VM should be installed.

      Important: Make sure you install the USM Anywhere Sensor in the network where the assets that you want to monitor are located.

    • Extensions — Leave blank.
    • High availability — Leave blank.
    • Monitoring — Leave this disabled unless you want to store USM Anywhere Sensor logs for monitoring purposes.

    Set the storage and network for the sensor VM instance

  8. Click OK.
  9. On the Summary blade, review your specifications and the cost summary.

    Review the specifications and costs associated with the VM and click Create

  10. Click Create.

    This starts the deployment of the USM Anywhere Sensor, which can take up to six minutes.

  11. After deployment finishes, locate the Public IP address for the virtual machine by reviewing the virtual machine overview.

    Copy the public IP for the USM Anywhere Sensor VM

    Make note of this IP address so that you have it for configuring your data sources to send data to the Sensor.

  12. Click the IP address link to launch the USM Anywhere Sensor Setup page.

    Important: This link requires that inbound port 80 is open for the Sensor VM, which is not a default network setting on Azure. For more information about required connectivity for the Azure sensor, see Sensor Ports and Connectivity.


Setting the Azure Sensor Connection to USM Anywhere