Configure an Analyzer

3. Overview
4. Prerequisites
5. Windows 

1. Steps 

3. Configure Analyzer
4. Deploy Analyzer
5. Enable and Configure File Audit

4. AWS 

1. Steps 

2. Configure Analyzer
3. Deploy Analyzer

Overview

An analyzer is the component that monitors a storage location, analyzes files, takes response actions and sends alerts. Unlike the Management Service, Analyzers are deployed in the customer’s environment. Analyzers are deployed as containers or as compiled python, which can be installed as a service on Windows.

Prerequisites

You must have already defined a site in your Admin Portal.

Windows

Steps

Configure Analyzer

Currently, an analyzer needs to be added and saved before you can do a deployment. There are some server side actions that need to happen, and those aren’t triggered until you click Save on a new analyzer.

1. Add a new Analyzer. In the Admin Portal, click on Analyzers, and click the button in the top right corner.
2. Enter Analyzer Name
3. For Type, choose SMB
4. Choose Site, Region, and Policy
5. Click Save

Deploy Analyzer

1. Select your Analyzer and click the Edit (pencil) icon
2. Click the Deploy button
3. Click the Installer button to download the installer
4. Cop the installer zip file to the server you want to install onto
5. Unzip the installer file
6. Right click on INSTALL.ps1 and click Run as Administrator
7. Follow the instructions

Enable and Configure File Audit

Instructions can be found here

AWS

Steps

Configure Analyzer

Currently, an analyzer needs to be added and saved before you can do a deployment. There are some server side actions that need to happen, and those aren’t triggered until you click Save on a new analyzer.

If you need to send the CloudFormation template to another person to install (or for approval), you can click View Template and save the file locally. If you have cloud admin permissions, you can deploy the CloudFormation template directly from the RansomStop Admin Portal.

1. Add a new Analyzer. In the Admin Portal, click on Analyzers, and click the button in the top right corner.
2. Enter Analyzer Name
3. For Type, choose S3
4. Choose Site, Region, and Policy
5. Expand the Networking section
6. You will need to provide a VPC and 1-3 subnets from that VPC.

There is a convenient cloud button to take you to your AWS console so you can copy/paste the VPC and Subnet IDs. Subnet IDs should be 1 per line, max 3, no punctuation or extra characters.

5. Click Save

Deploy Analyzer

1. Deploy Template. Select your Analyzer

If the edit icon is green, the Analyzer has already been deployed. If it is orange, it has not yet been deployed.

2. Expand the Deployment Section and click Deploy Template

3. Create Stack. Click Next.

4. Stack Details. Click Next.

5. Stack Options. Click Acknowledge and Click Next.

6. Stack Create

7. Acknowledge
8. Go back to the Admin Portal, to the Analyzer dialog
9. Click the Policy Deployed slider and click Save