Threat Grid supports the following browsers:

• Google Chrome™

• Mozilla Firefox®

• Apple Safari®

Note	Microsoft Internet Explorer is not supported.

Secure Malware Analytics Appliance (v2.7.2 and later) is deployed on the Secure Malware Analytics M5 Appliance server. Before you set up and configure the Secure Malware Analytics Appliance, make sure the necessary environmental requirements for power, rack space, cooling, and other issues are met, according to the specifications in the Cisco Threat Grid M5 Hardware Installation Guide.

The SFP+ form factor is used for the Admin interface. If you are clustering Secure Malware Analytics Appliances, each one will require an additional SFP+ module on the Clust interface.

Note	The SFP+ modules must be connected before the Secure Malware Analytics Appliance is powered on for the session in which the configuration wizard is going to be run.

If there are no SFP+ ports available on the switch, or SFP+ is not desirable, then a transceiver for 1000Base-T can be used (for example, Cisco Compatible Gigabit RJ 45 Copper SFP Transceiver Module Mini -GBIC - 10/100/1000 Base-T Copper SFP Module).

You can attach a monitor to the server, or, if Cisco Integrated Management Controller (CIMC) is configured, you can use a remote KVM (on UCS C220-M3 and C220-M4 servers).

Note	CIMC is not supported on the Secure Malware Analytics M5 Appliance server.

The Cisco UCS Power Calculator is available to get a power estimate.

The Secure Malware Analytics Appliance requires three networks:

• ADMIN - The Administrative network must be configured to perform the Secure Malware Analytics Appliance setup.

  • Admin UI Management Traffic (HTTPS)

  • SSH

  • NFSv4 (Outbound. If a NFS hostname is used instead of IP, this name will be resolved via Dirty DNS.)

• CLEAN - The Clean network is used for inbound, trusted traffic to the Secure Malware Analytics Appliance (requests), and integrated appliances such as the Cisco Email Security Appliance and Web Security Appliance; integrated appliances connect to the IP address of the Clean interface.

  Note	The URL for the Clean network interface will not work until the Admin UI configuration is complete.

  The following specific, restricted types of network traffic can be outbound from the Clean network:

  • Remote syslog connections

  • Email messages sent by the Secure Malware Analytics Appliance

  • Disposition Update Service connections to Secure Endpoint Private Cloud devices

  • DNS requests (related to any of the above)

  • LDAP

• DIRTY - The Dirty network is used for outbound traffic from the Secure Malware Analytics Appliance (including malware traffic).

  Note	To protect your internal network assets, we recommend using a dedicated external IP address (for example, the Dirty interface) that is different from your corporate IP.

For network interface setup information, see Network Interfaces.

The DNS server needs to be accessible via the Dirty network when used for purposes other than Disposition Update Service lookups, resolving remote syslog connections, and resolving the mail server used for notifications from the Secure Malware Analytics software.

By default, DNS uses the Dirty interface. The Clean interface is used for Secure Endpoint Private Cloud integrations and other services. If the Secure Endpoint Private Cloud hostname cannot be resolved over the Dirty interface, then a separate DNS server that uses the Clean interface can be configured in the Admin UI.

By default, the NTP server needs to be accessible via the Dirty network.

Starting with the 2.12 release, an appliance can be optionally configured to connect to an NTP server from the clean interface rather than the dirty interface (default). This makes it possible to use an internal NTP server.

Additional planning is required if the Secure Malware Analytics Appliance is going to be used with other Cisco products, such as the Email Security Appliance, Web Security Appliance, or Secure Endpoint Private Cloud. See Connecting ESA/WSA to Threat Grid Appliance for more information.

If you are connected to a network configured to use DHCP, it is important that you understand the requirements. Secure Malware Analytics Appliances that use DHCP need to explicitly specify DNS.

Warning

An upgrade of a system without a DNS server explicitly specified will fail.

Note	The Admin TUI displays the information you will need to access and configure the Admin UI. It may take some time for the IP addresses for DHCP to display after your appliance boots.

Open the Admin TUI (Text-mode UI) and note the following information:

• Admin URL - The Admin network. You will need this address in order to continue the remaining configuration tasks in the Admin UI.

• Application URL - The Clean network. This is the address to use after completing the configuration in the Admin UI.

  The Dirty network is not shown.

• Password - The initial Admin password that is randomly generated during the Secure Malware Analytics Appliance installation. You will need to change this password later as the first step the Admin UI configuration process.

If you need to change your initial IP assignments from DHCP to static IP addresses, see Configuring Network and DHCP.

When a new appliance is purchased, a license is generated and the Retrieve License From Server button on the Configuration > License page is enabled. However, if that does not work or if there is a special case (such as a license being a custom one-off), then you will be given the license directly, as an encrypted file with a password.

For additional questions about licenses, contact Support.

The API sample submission rate limit is global for the Secure Malware Analytics Appliance under the terms of the license agreement. This affects API submissions ONLY, not manual sample submissions.

Rate limits are based on a window of rolling time, not to a calendar day. When the submission limit is exhausted, the next API submission will return a 429 error, plus a message about how long to wait before retrying. See the portal online Help for more information.

Once you have completed the Secure Malware Analytics Appliance setup and network configuration, you must create the initial Secure Malware Analytics organizations and add user account(s), so that people can login and begin submitting malware samples for analysis. This task may require planning and coordination among multiple organizations and users, depending on your requirements.

See Create New Organizations and the Secure Malware Analytics portal Help (click Administration > Administrator's Guide to open the Administration Guide topic) for additional information.

The initial Secure Malware Analytics Appliance setup and configuration steps must be completed before installing any Secure Malware Analytics Appliance updates. We recommend that you check for updates immediately after completing the initial configuration (see the Cisco Threat Grid Appliance Getting Started Guide).

Secure Malware Analytics Appliance updates cannot be downloaded until the license is installed, and expect where otherwise directed by the customer support, the update process requires that the initial appliance configuration is completed. Updates must be done in sequence.

After the server has been correctly attached to the network and powered up, there are several user interfaces available for configuring the Secure Malware Analytics Appliance.

Note	LDAP authentication is available for Admin TUI and the Admin UI. RADIUS authentication is available for the Secure Malware Analytics Application UI (v2.10 and later).

The available network interfaces are described in the following table:

This section provides suggested firewall rules.

Note	Implementing a restrictive outgoing policy on the Dirty interface for ports 22 and 19791 requires tracking updates over time and spending more time maintaining the firewall.

Note	Using IPv4LL address space (168.254.0.16) for the Dirty interface is not supported.

When submitting samples to a Secure Malware Analytics Appliance for analysis, an important consideration is the privacy of the content. Privacy is a particularly important consideration if sensitive documents or archive types are submitted for analysis, because locating sensitive material could be relatively easy for those with access to the Secure Malware Analytics Appliance, especially with the search API.

The privacy and sample visibility model for sample submissions to Secure Malware Analytics is as follows:

• Unless samples are designated as Private, they are visible to users who are outside the submitter's organization.

• Private samples can only be seen by Secure Malware Analytics users within the same organization as the user who submitted the sample.

The Wipe Appliance operation enables you to wipe the disks on a Secure Malware Analytics Appliance to remove all data prior to decommissioning or returning it to the Cisco Demo Loan Program.

Important

After performing the wipe appliance procedure, the Secure Malware Analytics Appliance will no longer operate without being returned to Cisco for reimaging (Except for demo loan program customers, re-imaging service is not guaranteed to be available without prior agreement).

For more information, see Removing All Data with the Wipe Appliance Operation.