Threat Grid supports the following browsers:

• Google Chrome™

• Mozilla Firefox®

• Apple Safari®

Note	Microsoft Internet Explorer is not supported.

Threat Grid Appliance (v2.7.2 and later) is deployed on the Threat Grid M5 Appliance server. Before you set up and configure the Threat Grid Appliance, make sure the necessary environmental requirements for power, rack space, cooling, and other issues are met, according to the specifications in the Cisco Threat Grid M5 Hardware Installation Guide.

The SFP+ form factor is used for the Admin interface. If you are clustering Threat Grid Appliances, each one will require an additional SFP+ module on the Clust interface.

Note	The SFP+ modules must be connected before the Threat Grid Appliance is powered on for the session in which the configuration wizard is going to be run.

If there are no SFP+ ports available on the switch, or SFP+ is not desirable, then a transceiver for 1000Base-T can be used (for example, Cisco Compatible Gigabit RJ 45 Copper SFP Transceiver Module Mini -GBIC - 10/100/1000 Base-T Copper SFP Module).

You can attach a monitor to the server, or, if Cisco Integrated Management Controller (CIMC) is configured, you can use a remote KVM (on UCS C220-M3 and C220-M4 servers).

Note	CIMC is not supported on the Threat Grid M5 Appliance server.

The Cisco UCS Power Calculator is available to get a power estimate.

The Threat Grid Appliance requires three networks:

• ADMIN - The Administrative network must be configured to perform the Threat Grid Appliance setup.

  • Admin UI Management Traffic (HTTPS)

  • SSH

  • NFSv4 (Outbound. If a NFS hostname is used instead of IP, this name will be resolved via Dirty DNS.)

• CLEAN - The Clean network is used for inbound, trusted traffic to the Threat Grid Appliance (requests), and integrated appliances such as the Cisco Email Security Appliance and Web Security Appliance; integrated appliances connect to the IP address of the Clean interface.

  Note	The URL for the Clean network interface will not work until the Admin UI configuration is complete.

  The following specific, restricted types of network traffic can be outbound from the Clean network:

  • Remote syslog connections

  • Email messages sent by the Threat Grid Appliance

  • Disposition Update Service connections to AMP for Endpoints Private Cloud devices

  • DNS requests (related to any of the above)

  • LDAP

• DIRTY - The Dirty network is used for outbound traffic from the Threat Grid Appliance (including malware traffic).

  Note	To protect your internal network assets, we recommend using a dedicated external IP address (for example, the Dirty interface) that is different from your corporate IP.

For network interface setup information, see Network Interfaces.

The DNS server needs to be accessible via the Dirty network when used for purposes other than Disposition Update Service lookups, resolving remote syslog connections, and resolving the mail server used for notifications from the Threat Grid software.

By default, DNS uses the Dirty interface. The Clean interface is used for AMP for Endpoints Private Cloud integrations. If the AMP for Endpoints Private Cloud hostname cannot be resolved over the Dirty interface, then a separate DNS server that uses the Clean interface can be configured in the Admin UI.

The NTP server needs to be accessible via the Dirty network.

Starting with the 2.12 release, an appliance can be optionally configured to connect to an NTP server from the clean interface rather than the dirty interface (default). This makes it possible to use an internal NTP server.

Additional planning may be required if the Threat Grid Appliance is going to be used with other Cisco products, such as the Email Security Appliance, Web Security Appliance, or AMP for Endpoints Private Cloud. See Connecting ESA/WSA to Threat Grid Appliance for more information.

If you are connected to a network configured to use DHCP, it is important that you understand the requirements. Threat Grid Appliances that use DHCP need to explicitly specify DNS.

Warning

An upgrade of a system without a DNS server explicitly specified will fail.

Note	The TGSH Dialog displays the information you will need to access and configure the Admin UI. It may take some time for the IP addresses for DHCP to display after your appliance boots.

Open the TGSH Dialog and note the following information:

• Admin URL - The Admin network. You will need this address in order to continue the remaining configuration tasks in the Admin UI.

• Application URL - The Clean network. This is the address to use after completing the configuration in the Admin UI.

  The Dirty network is not shown.

• Password - The initial Admin password that is randomly generated during the Threat Grid Appliance installation. You will need to change this password later as the first step the Admin UI configuration process.

If you need to change your initial IP assignments from DHCP to static IP addresses, see Configuring Network and DHCP.

When a new appliance is purchased, a license is generated and the Retrieve License From Server button on the Configuration > License page is enabled. However, if that doesn't work or if there's a special case (such as a license being a custom one-off), then you will be given the license directly, as an encrypted file with a password.

For additional questions about licenses, contact Support.

The API sample submission rate limit is global for the Threat Grid Appliance under the terms of the license agreement. This affects API submissions ONLY, not manual sample submissions.

Rate limits are based on a window of rolling time, not to a calendar day. When the submission limit is exhausted, the next API submission will return a 429 error, plus a message about how long to wait before retrying. See the portal online Help for more information.

Once you have completed the Threat Grid Appliance setup and network configuration, you must create the initial Threat Grid organizations and add user account(s), so that people can login and begin submitting malware samples for analysis. This task may require planning and coordination among multiple organizations and users, depending on your requirements.

See Create New Organizations and the Threat Grid portal Help (click Administration > Administrator's Guide to open the Administration Guide topic) for additional information.

The initial Threat Grid Appliance setup and configuration steps must be completed before installing any Threat Grid Appliance updates. We recommend that you check for updates immediately after completing the initial configuration (see the Cisco Threat Grid Appliance Getting Started Guide).

Threat Grid Appliance updates cannot be downloaded until the license is installed, and the update process requires that the initial appliance configuration is completed. Updates must be done in sequence.

After the server has been correctly attached to the network and powered up, there are several user interfaces available for configuring the Threat Grid Appliance.

Note	LDAP authentication is available for TGSH Dialog and the Admin UI. RADIUS authentication is available for the Threat Grid Application UI (v2.10 and later).

The available network interfaces are described in the following table:

This section provides suggested firewall rules.

Note	Implementing a restrictive outgoing policy on the Dirty interface for ports 22 and 19791 requires tracking updates over time and spending more time maintaining the firewall.

Note	Using IPv4LL address space (168.254.0.16) for the Dirty interface is not supported.

When submitting samples to a Threat Grid Appliance for analysis, an important consideration is the privacy of the content. Privacy is a particularly important consideration if sensitive documents or archive types are submitted for analysis, because locating sensitive material could be relatively easy for those with access to the Threat Grid Appliance, especially with the search API.

The privacy and sample visibility model for sample submissions to Threat Grid is as follows:

• Unless samples are designated as Private, they are visible to users who are outside the submitter's organization.

• Private samples can only be seen by Threat Grid users within the same organization as the user who submitted the sample.

The Wipe Appliance operation enables you to wipe the disks on a Threat Grid Appliance to remove all data prior to decommissioning or returning it to the Cisco Demo Loan Program.

Important

After performing the wipe appliance procedure, the Threat Grid Appliance will no longer operate without being returned to Cisco for reimaging.

For more information, see Removing All Data with the Wipe Appliance Operation.