Set up Broker VM on Amazon Web Services - Learn how to set up your Cortex XDR Broker virtual machine (VM) on AWS. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Log in to the AWS IAM Console, and in the navigation pane, select Access Management → Users, and click Create user.

Under User name, specify a username, and click Next.

In the Permissions options section, select Attach Existing Policies directly, and then in the Permissions policies section, click Create policy.

In the JSON tab, copy and paste the following syntax to define the policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": ["arn:aws:s3:::mys3bucket","arn:aws:s3:::mys3bucket/*"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CancelConversionTask",
        "ec2:CancelExportTask",
        "ec2:CreateImage",
        "ec2:CreateInstanceExportTask",
        "ec2:CreateTags",
        "ec2:DescribeConversionTasks",
        "ec2:DescribeExportTasks",
        "ec2:DescribeExportImageTasks",
        "ec2:DescribeImages",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeInstances",
        "ec2:DescribeSnapshots",
        "ec2:DescribeTags",
        "ec2:ExportImage",
        "ec2:ImportInstance",
        "ec2:ImportVolume",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances",
        "ec2:ImportImage",
        "ec2:ImportSnapshot",
        "ec2:DescribeImportImageTasks",
        "ec2:DescribeImportSnapshotTasks",
        "ec2:CancelImportTask"
      ],
      "Resource": "*"
    }
  ]
}

Click Next.

In the Policy details section, under Policy name, specify a name for the policy, and click Create policy.

Select the policy that you created above based on the syntax you added, and click Next.

Complete the user creation process by clicking Create user.

After confirmation that the user is created, select the user that you created.

Open the Security credentials tab, scroll down to the Access key section, and click Create access key.

In Step 1 Access key best practices & alternatives perform the following:

1. Select the Command Line Interface (CLI) option.

2. Select the Confirmation checkbox.

3. Click Next.

(Optional) In Step 2 Set description tag, you can enter a description for the access key, or leave it empty, and then click Create access key.

In Step 3 Retrieve access keys, copy the following user information, which you will need later:

In the Cortex XDR Web Console , select Settings → Configurations → Data Broker → Broker VMs → Add Broker → VMDK.

Download the VMDK file, such as broker-vm-<broker-vm-version>.vmdk, to your computer.

Navigate and log in to your AWS account.

In the AWS Console, select All services → Storage → S3.

On the Buckets page, click Create bucket to upload your Broker VM image to this bucket.

Specify a unique name for the S3 bucket and use the default configurations.

Upload the Broker VM VMDK you downloaded from Cortex XDR to the AWS S3 bucket using one of the following methods:

Prepare the following configurations files on your hard drive.

Use the create-role command to create a role named vmimport and grant VM import and export permissions using the trust-policy.json file.

# aws iam create-role --role-name vmimport --assume-role-policy-document "file://trust-policy.json"

Use the put-role-policy command to attach the policy to the vmimport role created above.

# aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document "file:// role-policy.json"

Create a snapshot from the VMDK file.

Run the following command to start the import process:

# aws ec2 import-snapshot --description "<Cortex XDR Broker VM <Version>" --disk-container "file://configuration.json"

To track the progress, use the task id value from the output and run:

# aws ec2 describe-import-snapshot-tasks --import-task-ids import-snap-<task-id>

{
    "ImportSnapshotTasks": [
        {
            "Description": "Broker VM <version> snapshot import",
            "ImportTaskId": "import-snap-12346b69617c1395t",
            "SnapshotTaskDetail": {
                ...
                "DiskImageSize": 2976817664.0,
                "Format": "vmdk",
                "SnapshotId": "snap-1234567890",
                "Status": "completed",
                "UserBucket": {
                    "S3Bucket": "broker-vm",
                    "S3Key": "broker-vm-<version>.vmdk"
                }
            },
            "Tags": []
        }
    ]
}

Register the AMI from the snapshot.

Once the describe-import-snapshot-tasks command shows a status of completed, a new Snapshot has been created in your account. You must now register this snapshot as an AMI.

Once the task is complete, the AMI Image is ready for use.

(Optional) After the AMI image has been created, you can define a new name for the image.

Select All services → EC2 → IMAGES → AMIs and locate your AMI image using the task ID. Select the pencil icon to specify a new name.

To view the AMI image that you added, select All services → EC2 → Images → AMIs.

Select EC2 → Instances, and click Launch instances to create an instance of the AMI image.

In the Launch Instance Wizard define the instance according to your company requirements and Launch.

(Optional) In the Instances page, locate your instance and use the pencil icon to rename the instance Name.

Define HTTPS and SSH access (optional) to your instance.

Select your instance and then choose Actions → Security → Change security groups.

Attach a security group that allows HTTPS to access the Broker VM Web UI and SSH for remote access when troubleshooting. Make sure to allow these connections to the Broker VM from secure networks only.

Verify the Broker VM has started correctly.

On the Instances page, select your instance, and the choose Actions → Monitor and troubleshoot → Troubleshoot → Get instance screenshot.

You are directed to your Broker VM console listing your Broker details.