Distributed Cloud AIP Agent CoreOS Installation Overview

As of June 2017, F5 Distributed Cloud App Infrastructure Protection (AIP) supports CoreOS Stable channel v1353.8.0 and later.

Installation Methods for Agent 1.8.0C and Newer

Distributed Cloud AIP recommends installing CoreOS as a container-based Agent, rather than as a host-based Agent. For instructions, see Distributed Cloud AIP Containerized Agent.

Previous Installation Method

Latest CoreOS Installer

To install the Agent software, run CoreOS installer from the untarred package directory:  

tar -xvzf threatstack-agent_latest.coreos1353.8.0_amd64.tar.gz
cd threatstack-agent_1.6.6-7.coreos1353.8.0_amd64

After you have run the Agent installer, you have two methods that you can use to complete the installation process. You can execute the cloudsight setup arguments doing a single command or you can install the Agent manually.

Note

The version number varies slightly based on the latest Agent release version. This means that the version number you see may differ from the one in this article.

Single Command Manual Alternative

CoreOS installs the Agent software and dependencies under /opt/threatstack and lists the Distributed Cloud AIP Agent as a standard systemd service.

You can install the Distributed Cloud AIP Agent using the cloudsight setup arguements by running this single command:

sudo ./threatstack-coreos-installer.sh --deploy-key=KEY

Reminder

The KEY is your deploy key. Distributed Cloud AIP requires that you provide the deploy key to authenticate.

Additional installer and Agent registration options include:

Installer options:
 -s, --silent                  Skip installation prompts.
 -h, --help                    Print this message.

Automatic agent registration options:
 -a, --agent_type              Agent type ([i]nvestigate or [m]onitor).
                                Default: (i)nvestigate
 -k KEY, --deploy-key=KEY      Automatically register this agent using the
                                specified deployment key.
 -r, --ruleset                 Ruleset(s) to initially use.
 -u, --url                     URL to use to communicate with ThreatStack.
                                Default: https://app.threatstack.com
		

CoreOS installs the Agent software and dependencies under /opt/threatstack and lists the Distributed Cloud AIP Agent as a standard systemd service.

You can choose to manually setup using the following command:

sudo ./threatstack-coreos-installer.sh

Additional installer options include:

Installer options:
 -s, --silent                  Skip installation prompts.
 -h, --help                    Print this message.
	

The first time you start the Agent, provide your deploy key to authenticate with the Distributed Cloud AIP service and run:

/opt/threatstack/bin/cloudsight setup --deploy-key=KEY

Important

The KEY is your deploy key. Distributed Cloud AIP requires that you provide the deploy key to authenticate.

CoreOS automatically enables container monitoring. To disable it, run:

/opt/threatstack/bin/cloudsight config enable_containers=0
/opt/threatstack/bin/cloudsight restart

Check Service Connection

To verify that your Agent is connected inside the Distributed Cloud AIP application, navigate to the Servers page.

To check the status of the service connection and various services maintained by the Agent, run: 

/opt/threatstack/bin/cloudsight status

For more options, run:

/opt/threatstack/bin/cloudsight --help

Uninstall Agent

To uninstall CoreOS, run:

sudo cloudsight stop
sudo rm -rf /opt/threatstack /etc/init.d/cloudsight /opt/bin/cloudsight