Installing Sensors from the Capsule8 Console

Prerequisites

• Have Capsule8 Console version 4.4.1 or later.
• The Package Cloud token should be set in the Console Configuration with the console.package_token setting.
• Console 4.4.1: To use "Quick Install", enable Console control of the Capsule8 Sensor with the console.policy_config_enabled setting. This setting defaults to true in Console version 4.5.0 and later.
• Console 4.5.0 and later: If you require the "Quick Install" dialog to install a specific sensor version, configure console.quick_install_sensor_version to e.g. "4.5.0".
• Non-admin users require the "Add New Resources" permission.

Introduction

After the installation, the user will be prompted with this dialog:

You may select either Manual Install or Quick Install to set up the sensor from the Console UI. Capsule8 recommends using Quick Install.

Once you have hosts connected, this dialog no longer appears on login. In Console 4.5.0 and later, users may re-open this dialog to install additional sensors by navigating to Resources and clicking Add Resource.

Quick Installation of Sensors from Console UI

Follow the on-screen guide to install the Capsule8 Sensor.

Press Finish to complete the installation. As of Console 4.5.0, you will see a walkthrough of the Console's alert handling functionality.

Manual Installation of Sensors from Console UI

If Manual Install is selected, user will be presented with the below step

The configuration here may be copy/pasted into your /etc/capsule8/capsule8-sensor.yaml to add a new Sensor to this instance of the Console. As of Console 4.6.0, this configuration always includes a webhook alert_output block. Consoles already configured with S3/SQS additionally include a commented-out S3 alert_output block. Users who prefer to transport alerts via S3 may uncomment and edit this block. See Getting Started: Exporting Alerts to learn about additional alert output configurations.