ASMS integration to SaaS services

This topic describes how to create a connection between AppViz and ASMS.

ASMS-AppViz integration enables these features:

  • ASMS Azure tree completeness

  • AWS / Azure Map completeness, TSQ accuracy and FireFlow recommendations

  • Google Cloud visibility in ASMS

Prerequisites

Supported ASMS versions: Can be integrated with ASMS A32.20 and above.

Connect AppViz to ASMS

This procedure describes how the Admin role can create a AppViz trust token and enter it in ASMS, thus establishing a trust and connecting the two systems.

Note: The following steps are relevant both for existing customers of other AlgoSec SaaS solutions and for customers connecting ASMS to AlgoSec SaaS Services for the first time.

Note: ASMS-AlgoSec SaaS integration supports integrating a single ASMS host (i.e. production, testing or Beta) to each AlgoSec SaaS tenant. If you need to change the ASMS host integrated to AlgoSec SaaS, follow Offboard AlgoSec SaaS (AlgoSec Cloud, ObjectFlow, AppViz) from ASMS and then reconnect AppViz to ASMS. If you are also using other AlgoSec SaaS applications, reconnect as well.

Do the following:

  1. Connect to Kafka destination hosts:

    • Connect to the Kafka hosts in the required region.

      Allow outgoing HTTP traffic on port 8082 towards the Kafka hosts.

      Note: If your firewall configuration restricts the usage of these FQDNs for any reason, an alternative approach is to treat the resolved IPs as static instead.

      US region:

      • kafka1.us.algocare.algosec.com

      • kafka2.us.algocare.algosec.com

      • kafka3.us.algocare.algosec.com

      EU region:

      • kafka1.eu.algocare.algosec.com

      • kafka2.eu.algocare.algosec.com

      • kafka3.eu.algocare.algosec.com

      ANZ region:

      • kafka1.anz.algocare.algosec.com

      • kafka2.anz.algocare.algosec.com

      • kafka3.anz.algocare.algosec.com

      ME region:

      • kafka1.me.algocare.algosec.com

      • kafka2.me.algocare.algosec.com

      • kafka3.me.algocare.algosec.com

    Important: In order to maintain the security of your ASMS instance, AppViz is barred from establishing inbound connections to the ASMS host. AppViz-ASMS integration communication is always initiated by ASMS.

  2. Start in AppViz, and click the Settings icon at the bottom left of your screen.

  3. Select ASMS INTEGRATION.

    The ASMS Integration screen appears

  4. Click Download Certificate.

    Note the downloaded file's name (AlgoSec_Cloud_trust_establish_data-{tenant ID}.zip) and location for use in Step 5, below.

  5. Upload the trust file (AlgoSec_Cloud_trust_establish_data-{tenant ID}.zip) to the ASMS upgrade directory (/root/AlgoSec_Upgrade).

  6. Log in to your ASMS machine with username root.

    Note: More details regarding the algosec_conf utility can be found in Connect to the Administration interface in the ASMSDocumentation.

  7. Enter 14 to select option 14. Product and Cloud Configuration from the algosec_conf menu that is displayed .

  8. Enter 3 to select 3. Cloud Integration from the configuration items submenu.

  9. Enter 1 to select 1. Onboard AlgoSec Cloud components.


  10. When prompted for the path of the configuration file, enter: /root/AlgoSec_Upgrade/AlgoSec_Cloud_trust_establish_data-{tenant ID}.zip


    A message will indicate the success or failure of the ASMS-AppViz integration.

Offboard AlgoSec SaaS (AlgoSec Cloud, ObjectFlow, AppViz) from ASMS

To manually offboard (remove the trust between the subject ASMS machine and the target SaaS tenant):

Do the following:

  1. Login via SSH to the target ASMS machine as user root

  2. Recommended: Backup the folder: /home/afa/.fa/kafka

  3. Remove the tunnel:

    1. In the algosec_conf main menu, enter 14 Product and cloud configuration.

    2. Enter 3 Cloud Integration.

    3. Enter 2 HTTPS tunnel Configuration.

    4. Enter 2 Remove HTTPS tunnel.

    5. Confirm by entering y. The tunnel is removed.

  4. Delete the folder: /home/afa/.fa/kafka

  5. Open the file: /home/afa/.fa/config and remove the following parameters:

    1. Kafka_Tenant_Region

    2. Kafka_Tenant_Environment

    3. Cloud_Tenant_Id

    4. APPVIZCLOUD_ENABLED

    Save your changes.

  6. Run the following command: 

    service ms-cloudflow-broker restart