Threat Grid supports the following browsers:

• Google Chrome™

• Mozilla Firefox®

• Apple Safari®

Note	Microsoft Internet Explorer is not supported.

Threat Grid Appliance (v2.7.2 and later) is deployed on the Threat Grid M5 Appliance server. Before you set up and configure the Threat Grid Appliance, make sure the necessary environmental requirements for power, rack space, cooling, and other issues are met, according to the specifications in the Cisco Threat Grid M5 Hardware Installation Guide.

The SFP+ form factor is used for the Admin interface. If you are clustering Threat Grid Appliances, each one will require an additional SFP+ module on the Clust interface.

Note	The SFP+ modules must be connected before the Threat Grid Appliance is powered on for the session in which the configuration wizard is going to be run.

If there are no SFP+ ports available on the switch, or SFP+ is not desirable, then a transceiver for 1000Base-T can be used (for example, Cisco Compatible Gigabit RJ 45 Copper SFP Transceiver Module Mini -GBIC - 10/100/1000 Base-T Copper SFP Module).

You can attach a monitor to the server, or, if Cisco Integrated Management Controller (CIMC) is configured, you can use a remote KVM (on UCS C220-M3 and C220-M4 servers).

Note	CIMC is not supported on the Threat Grid M5 Appliance server.

The Cisco UCS Power Calculator is available to get a power estimate.

The Threat Grid Appliance requires three networks:

• ADMIN - The Administrative network must be configured to perform the Threat Grid Appliance setup.

  • OpAdmin Management Traffic (HTTPS)

  • SSH

  • NFSv4 (Outbound. If a NFS hostname is used instead of IP, this name will be resolved via Dirty DNS.)

• CLEAN - The Clean network is used for inbound, trusted traffic to the Threat Grid Appliance (requests), and integrated appliances such as the Cisco Email Security Appliance and Web Security Appliance; integrated applicances connect to the IP address of the Clean interface.

  Note	The URL for the Clean network interface will not work until the OpAdmin portal configuration is complete.

  The following specific, restricted types of network traffic can be outbound from the Clean network:

  • Remote syslog connections

  • Email messages sent by the Threat Grid Appliance

  • Disposition Update Service connections to AMP for Endpoints Private Cloud devices

  • DNS requests (related to any of the above)

  • LDAP

• DIRTY - The Dirty network is used for outbound traffic from the Threat Grid Appliance (including malware traffic).

  Note	To protect your internal network asses, we recommend using a dedicated external IP address (for example, the Dirty interface) that is different from your corporate IP.

For network interface setup information, see Network Interfaces.

The DNS server needs to be accessible via the Dirty network when used for purposes other than Disposition Update Service lookups, resolving remote syslog connections, and resolving the mail server used for notifications from the Threat Grid software.

By default, DNS uses the Dirty interface. The Clean interface is used for AMP for Endpoints Private Cloud integrations. If the AMP for Endpoints Private Cloud hostname cannot be resolved over the Dirty interface, then a separate DNS server that uses the Clean interface can be configured in the OpAdmin interface.

See the Cisco Threat Grid Appliance Administrator Guide for additional information.

The NTP server needs to be accessible via the Dirty network.

Additional planning may be required if the Threat Grid Appliance is going to be used with other Cisco products, such as the Email Security Appliance, Web Security Appliance, or AMP for Endpoints Private Cloud. See the Cisco Threat Grid Appliance Administrator Guide for more information.

If you are connected to a network configured to use DHCP, follow the instructions provided in the Using DHCP section of the Cisco Threat Grid Appliance Administrator Guide.

You will receive a license and password from Cisco Threat Grid.

For questions about licenses, contact Threat Grid Support.

Once you have completed the Threat Grid Appliance setup and network configuration, you must create the initial Threat Grid organizations and add user account(s), so that people can login and begin submitting malware samples for analysis. This task may require planning and coordination among multiple organizations and users, depending on your requirements.

See the Create New Organization section in the Cisco Threat Grid Appliance Administrator Guide. See the Threat Grid portal Help for information about managing users.

The initial Threat Grid Appliance setup and configuration steps must be completed before installing any Threat Grid Appliance updates. We recommend that you check for updates immediately after completing the initial configuration (see Install Updates).

Threat Grid Appliance updates cannot be downloaded until the license is installed, and the update process requires that the initial appliance configuration is completed. Updates must be done in sequence.

Note	Verify that SSH is specified for updates.

After the server has been correctly attached to the network and powered up, there are several user interfaces available for configuring the Threat Grid Appliance.

Note	LDAP authentication is available for TGSH Dialog and OpAdmin (v2.1.6 and later).

The available network interfaces are described in the following table:

This section provides suggested firewall rules.

Note	Implementing a restrictive outgoing policy on the Dirty interface for ports 22 and 19791 requires tracking updates over time and spending more time maintaining the firewall.

Note	Using IPv4LL address space (168.254.0.16) for the Dirty interface is not supported.

The default login names and passwords are listed in the following table:

The following setup and initial configuration steps are described in this guide:

• Initial Network Configuration

• OpAdmin Portal Configuration

• Installing Updates

• Testing Appliance Setup

Complete the remaining administrative configuration tasks (such as license installation, email server, and SSL certificates) in the OpAdmin Portal as documented in the Cisco Threat Grid Appliance Administrator Guide.

You should allow approximately 1 hour to complete the initial configuration steps.