The Cisco Threat Grid appliance provides safe and highly secure on-premises advanced malware analysis, with deep threat analytics and content. A Threat Grid Appliance provides the complete Threat Grid malware analysis platform, installed on a Cisco Threat Grid M5 Appliance server (v2.7.2 and later). It empowers organizations operating under various compliance and policy restrictions, to submit malware samples to the appliance.

Note	Cisco UCS C220-M3 (TG5000) and Cisco UCS C220 M4 (TG5400) servers are still supported for Threat Grid Appliance but the servers are end of life. See the Server Setup chapter in the Cisco Threat Grid Appliance Setup and Configuration Guide (v2.7 and earlier) for instructions.

Many organizations that handle sensitive data, such as banks and health services, must follow various regulatory rules and guidelines that do not allow certain types of files, such as malware artifacts, to be sent outside of the network for malware analysis. By maintaining a Cisco Threat Grid Appliance on-premises, organizations can send suspicious documents and files to it to be analyzed without leaving the network.

With a Threat Grid Appliance, security teams can analyze all samples using proprietary and highly secure static and dynamic analysis techniques. The appliance correlates the analysis results with hundreds of millions of previously analyzed malware artifacts, to provide a global view of malware attacks and campaigns, and their distributions. A single sample of observed activity and characteristics can quickly be correlated against millions of other samples to fully understand its behaviors within an historical and global context. This ability helps security teams to effectively defend the organization against threats and attacks from advanced malware.

Before a new appliance can be used for malware analysis, it must be set up and configured for the organization's network. This guide is intended for the security team IT staff tasked with setting up and configuring a new Threat Grid Appliance.

This document describes how to complete the initial setup and configuration for a new Threat Grid Appliance, up to the point where malware samples can be submitted to it for analysis.

It is assumed that you have gathered the necessary information and completed the planning steps as described in the Cisco Threat Grid Appliance Administration Guide.

It is also assumed that you have already set up the Threat Grid Appliance based on the instructions in the Cisco Threat Grid M5 Hardware Installation Guide.

If you have not yet completed these two tasks, please do so before you begin the steps described in this Getting Started Guide.

The latest versions of Cisco Threat Grid Appliance product documentation can be found on Cisco.com:

• Cisco Threat Grid Appliance Release Notes

• Cisco Threat Grid Version Lookup Table

• Cisco Threat Grid Appliance Administration Guide

• Cisco Threat Grid M5 Hardware Installation Guide

  Note	The Cisco Threat Grid M5 Appliance is supported in Threat Grid Version 3.5.27 and later, and appliance version 2.7.2 and later.

Note	Prior versions of Cisco Threat Grid Appliance product documentation can be found at Threat Grid Install and Upgrade.

The following changes have been implemented in this guide in Version 2.12:

Threat Grid supports the following browsers:

• Google Chrome™

• Mozilla Firefox®

• Apple Safari®

Note	Microsoft Internet Explorer is not supported.

The initial Threat Grid Appliance setup and configuration steps must be completed before installing any Threat Grid Appliance updates. We recommend that you check for updates immediately after completing the initial configuration (see Install Updates).

Threat Grid Appliance updates cannot be downloaded until the license is installed, and the update process requires that the initial appliance configuration is completed. Updates must be done in sequence.

Note	Verify that SSH is specified for updates.

The following setup and initial configuration steps are described in this guide:

• Initial Network Configuration

• Admin UI Configuration

• Installing Updates

• Testing Appliance Setup

Note	You should allow approximately 1 hour to complete the configuration.

Additional tasks that require administrator configuration (such as license installation, email server, and SSL certificates) are documented in the Cisco Threat Grid Appliance Administration Guide.