Cisco Tetration - Hands-On Lab

Module04 - Agent Config Intent

Agent Config Intent defines what features will be enabled for a group of sensors. The Config Intent can be tied to an Inventory Filter, which provides the capability to apply different configurations to different types of hosts. For example, you could define a profile enabling a specific set of features to all Windows machines, and a separate profile enabling a different set of features to all Linux machines. We will see an example of doing just that in the exercise below.

Click here to view a video of the tasks necessary to configure Tetration Agents for Windows and Linux machines.

Steps for this Module

Step 001 - Navigate to Agent Config
Step 002 - Create a Profile for Windows machines
Step 003 - Configure Windows Profile Settings
Step 004 - Configure Windows Profile Settings
Step 005 - Create a Profile for Linux machines
Step 006 - Configure Linux Profile Settings
Step 007 - Configure Linux Profile Settings
Step 008 - Create a Config Intent for Windows
Step 009 - Create a new Inventory Filter
Step 010 - Configure Inventory Filter for Windows OS
Step 011 - Apply the Inventory Filter to the Config Intent
Step 012 - Create a Config Intent for Linux
Step 013 - Create a new Inventory Filter
Step 014 - Configure Inventory Filter for Linux OS
Step 015 - Apply the Inventory Filter to the Config Intent

Select the Gear icon and select Agent Config.

Click Create Profile to being creating an Agent Config Profile that we will apply to Windows machines.

Enter the name Windows for the profile name, and select to enable Enforcement and Preserve rules.

Enforcement - This agent config intent setting provides the capability to enable/disable the enforcement feature. This can be useful to prevent a situation where you have a set of machines that you would like to ensure cannot be put into enforcement inadvertently.

Preserve Rules - When enabled, this setting will preserve any manually configured firewall rules that might be present on the servers when going into enforcement. It is common to set this to enabled, such as to preserve any rules that might have been previously configured.

Click to enable the following settings and then Save the configuration:

• PID Lookup
• Forensics
• Meltdown Exploit Detection
• Anamalous Cache Activity Detection

NOTE: The Auto-Upgrade setting will cause the agents to be upgraded automatically when Tetration code is updated. It is common to disable this feature in a production environment so that agents can be upgraded in a more controlled manner.

Select Create Profile to create a new Agent Config Profile for Linux machines.

Enter the profile name Linux, and enable Enforcement and Preserve Rules features.

Scroll down and Save the configuration.

Click Create Intent to begin creating the Windows Agent Config Intent.

Select to apply the profile that we just created called Windows, and select to create a new filter. This will create a new Inventory Filter that we will configure to match on the Windows Operating System.

Enter Windows for the name, and enter the query “OS contains MS”. Then save the new filter. This will match any machines with sensors installed that have “MS” in their Operating System name. Also notice that the filter already matches inventory items (your number of matched items may differ from the image).

Make sure the “to filter” field is set to the Windows inventory filter we just created, and select Save. We have now applied the new Config Intent. Any Windows machines matching the inventory filter we created will now have the configuration applied.

Create a new Config Intent for Linux machines.

Select to apply the Linux profile that we previously created, and select Create new filter.

Enter the name Linux and the query “OS contains CentOS”. This will match any machines with sensors installed that are running the CentOS Operating System. Later we will see how we can add additional OS flavors to this Config Intent.

Ensure that the Inventory Filter we just created called Linux is selected as the “to filter” and Save to apply the Config Intent.