WitFoo Precinct Streamer for MSSP

Deploy AMI - Configure Security group to allow access as follows Outbound: 9042/tcp and 5432/tcp to data.witfoocloud.com (over TLS 1.3) 443/tcp to library.witfoo.com, registry.witfoo.com (over TLS 1.3) Access to enabled API integrations (normally 443/tcp)

Inbound: 514/tcp/udp - syslog 6514/tcp - syslog over TLS 2055/udp - netflow 5044/tcp - Beats agents (over TLS)

Once the appliance is launched run through these steps:

1. SSH or terminal into the deployed Streamer node. For OVA and VHD deployments, the user is witfooadmin and password is F00theN0ise! The Cloud Marketplaces use SSH keys that are configured at launch.
2. Ensure the appliance has the correct/preferred IP address by running ifconfg
3. VERY IMPORTANT:: To discover what the Streamers Public/Routable IP Address is run curl https://ipinfo.io/ip . This is the IP address that will be used to send data to WitFoo Precinct Cloud. Make a note of the address so you can enter it in the next step.
4. Go to https://ach.witfoocloud.com  and log back in.
5. Under Admin -> Settings edit "Allowed IP addresses to send data or connect to the Cassandra cluster" to include the Internet routable (public IP) address(es) to include the addresses the Streamer node will use to connect to *.witfoocloud.com.
6. Scroll to the bottom of the settings page and hit the "Submit" button
7. On the streamer node: Execute sudo bash
8. Execute ./register
9. When asked if you have a license key, type Y then hit enter. Use the key that was assigned to your Precinct deployment. Select 3 to make the node a Streamer node.