Set up Broker VM on Amazon Web Services - Learn how to set up your Cortex XSIAM Broker virtual machine (VM) on AWS. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Log in to the AWS IAM Console, and in the navigation pane, select Access Management → Users → Add Users.

Select Access key - Programmatic access as the AWS credential type, and click Next: Permissions.

Select Attach Existing Policies directly → Create Policy,

In the JSON tab, copy and paste the following syntax to define the policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": ["arn:aws:s3:::mys3bucket","arn:aws:s3:::mys3bucket/*"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CancelConversionTask",
        "ec2:CancelExportTask",
        "ec2:CreateImage",
        "ec2:CreateInstanceExportTask",
        "ec2:CreateTags",
        "ec2:DescribeConversionTasks",
        "ec2:DescribeExportTasks",
        "ec2:DescribeExportImageTasks",
        "ec2:DescribeImages",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeInstances",
        "ec2:DescribeSnapshots",
        "ec2:DescribeTags",
        "ec2:ExportImage",
        "ec2:ImportInstance",
        "ec2:ImportVolume",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances",
        "ec2:ImportImage",
        "ec2:ImportSnapshot",
        "ec2:DescribeImportImageTasks",
        "ec2:DescribeImportSnapshotTasks",
        "ec2:CancelImportTask"
      ],
      "Resource": "*"
    }
  ]
}

Click Next until you can specify the Policy name, and then click Create Policy.

Select the policy that you created above based on the syntax you added.

Complete the user creation process.

After confirmation that the user is created, record the following user information, which you will need later.

In the Cortex XSIAM Web Console , select Settings → Configurations → Data Broker → Broker VMs → Add Broker → VMDK.

Download the VMDK file, such as broker-vm-<broker-vm-version>.vmdk, to your ubuntu computer.

Navigate and log in to your AWS account.

In the AWS Console, navigate to Services → Storage → S3 → Buckets.

In the S3 buckets page, + Create bucket to upload your Broker VM image to this bucket.

Specify a unique name for the S3 bucket and use the default configurations.

Upload the Broker VM VMDK you downloaded from Cortex XSIAM to the AWS S3 bucket.

Run

# aws s3 cp ~/<path/to/broker-vm-version.vmdk> s3://<your_bucket/broker-vm-version.vmdk>

Prepare the following configurations files on your hard drive.

Use the create-role command to create a role named vmimport and grant VM import and export access to the trust-policy.json file.

# aws iam create-role --role-name vmimport --assume-role-policy-document "file://trust-policy.json"

Use the put-role-policy command to attach the policy to the vmimport role created above.

# aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document "file:// role-policy.json"

Create a snapshot from the VMDK file.

Run the following command to start the import process:

# aws ec2 import-snapshot --description "<Cortex XSIAM Broker VM <Version>" --disk-container "file://configuration.json"

To track the progress, use the task id value from the output and run:

# aws ec2 describe-import-snapshot-tasks --import-task-ids import-snap-<task-id>

{
    "ImportSnapshotTasks": [
        {
            "Description": "Broker VM <version> snapshot import",
            "ImportTaskId": "import-snap-12346b69617c1395t",
            "SnapshotTaskDetail": {
                ...
                "DiskImageSize": 2976817664.0,
                "Format": "vmdk",
                "SnapshotId": "snap-1234567890",
                "Status": "completed",
                "UserBucket": {
                    "S3Bucket": "broker-vm",
                    "S3Key": "broker-vm-<version>.vmdk"
                }
            },
            "Tags": []
        }
    ]
}

Register the AMI from the snapshot.

Once the describe-import-snapshot-tasks command shows a status of completed, a new Snapshot has been created in your account. You must now register this snapshot as an AMI.

Once the task is complete, the AMI Image is ready for use.

(Optional) After the AMI image has been created, you can define a new name for the image.

Select Services → EC2 → IMAGES → AMIs and locate your AMI image using the task ID. Select the pencil icon to specify a new name.

To view the AMI image that you added, select Services → EC2 → Images → AMIs.

Select EC2 → Instances, and click Launch instances to create an instance of the AMI image.

In the Launch Instance Wizard define the instance according to your company requirements and Launch.

(Optional) In the Instances page, locate your instance and use the pencil icon to rename the instance Name.

Define HTTPS and SSH access (optional) to your instance.

Right-click your instance, and select Networking → Change Security Groups.

In the Change Security Groups pop-up, select HTTPS to be able to access the Broker VM Web UI, and SSH to allow for remote access when troubleshooting. Make sure to allow these connections to the Broker VM from secure networks only.

Verify the Broker VM has started correctly.

Locate your instance, right-click, and select Instance Settings → Get Instance Screenshot.

You are directed to your Broker VM console listing your Broker details.

Obtain a registration token from the Cortex XSIAM Web Console by selecting Settings → Configurations → Data Broker → Broker VMs → Add Broker → Generate Token.

Determine the IP Address of the EC2 instance and use it to open the Broker VM Web Console, such as https://<ip_address>:4443.

Complete the registration process by entering the token information.