BEYONDINSIGHT INSTALLATION GUIDE

This guide provides instructions and procedures for installing your BeyondInsight software.

Two software components comprise the solution: BeyondInsight management console and BeyondTrust Discovery Scanner. Analytics & Reporting is a supplementary configuration launched from the console and does not require a separate installer. Having a conceptual understanding of BeyondInsight's architecture is valuable before installing and configuring the components.

BeyondInsight is the industry’s most innovative, comprehensive privileged access management platform that maximizes visibility, simplifies deployment, automates tasks, improves security, and reduces privilege-related risks.

BeyondInsight sends scan requests to the Discovery Scanner, which is the engine that performs all discovery scans on your network. It can run as standalone software, but when paired with BeyondInsight, scan results are sent securely to the management console to populate the SQL Server database.

Analytics & Reporting is an additional web-based interface that provides comprehensive analytical tools and that creates reports from collective scan data. It facilitates trending and delta reports, anomaly detection, regulatory compliance, and prioritization.

ℹ️

Note

By default, the scanner is installed as a standalone component that does not initially recognize the console. You will configure the scanner to receive scan job requests from BeyondInsight and send completed scan results back securely.

ℹ️

Note

This guide assumes familiarity with Microsoft Server and SQL Server 2016 and later versions.

ℹ️

Note

The Web Policy Editor (WPE) is not installed out of the box with BeyondInsight. Contact your BeyondTrust representative for assistance with installing the WPE and its associated WPE service in your BeyondInsight environment.

Set up certificates

Certificates are used for secure communication between agents and BeyondInsight. Two types of certificates are used:

• SSL certificate: Required to encrypt communication
• Client certificate: Required to authenticate a client

You can use BeyondInsight certificates or create custom certificates using the BeyondInsight Configuration Tool.

Work with BeyondInsight certificates

The following certificates are used for communication between BeyondTrust software and BeyondInsight:

• eEyeEmsCA: Certification authority (CA) certificate
• EmsClientCert: Client authentication certificate
• eEyeEmsServer: Server authentication certificate

The CA certificate generates and validates client and server certificates. It is located on both the agent and the server in Trusted Root Certification Authorities in the Local Machine Store.

When connecting to BeyondInsight Web Service (for example, when Privilege Management for Desktops connects to the Event Service), the EmsClientCert certificate is used to authenticate the client, and the SSL certificate is used to encrypt the data. This prevents anonymous connections to the services. Typically, a certification authority such as VeriSign validates anonymous clients.

With BeyondInsight, a self-signed certificate is created and distributed with the client certificate. BeyondInsight can then work in a variety of environments, especially where network connectivity is an issue. This avoids the need to register each system instance with an online CA.

Internally, each client certificate contains a private-public key pair. During the SSL handshake, the server requests the client certificate. The client authenticates the certificate before initiating the connection, and the server validates it again when it is received.

ℹ️

Note

Only the "Generate Certificate MSI" option should be used for the endpoint clients. These endpoint clients must have the .NET Framework 4.7.2 installed as a prerequisite to running the MSI.

ℹ️

Note

The "Generate Certificate Zip" option should only be used to transfer certificates between BeyondInsight servers.

Install the eEyeEmsServer certificate on the server in the Local Machine Store, under the Personal Store. To verify that the certificate is valid, double-click the certificate.

The EmsClientCert certificate is used for communication between the agent and server when sending and receiving events. The certificate must be exported from the server and then imported on the agent.

1. Open the BeyondInsight Configuration Tool.
2. Click the Certificate Management link.
3. Select Export certificate.
4. Select Client Certificate as the Certificate type.
5. Enter a chosen Password. We recommend that you use the existing BeyondInsight Central Policy password.
6. Click the ellipses (…) to browse to your desired location.
   • Enter a File name and select Certificate files (*.pfx) as the Save as type. We recommend that you name the certificate eEyeEmsClient.pfx.
   • Click Save.
   • Verify the Path has been filled in correctly.
7. Click OK.

Troubleshoot BeyondInsight certificates

When troubleshooting certificate issues, check the following:

• Is the eEyeEmsCA certificate expired?
• Does the certificate store have more than one version of the eEyeEmsCA certificate?
• Does the eEyeEmsCA certificate have the correct usage identifiers in place?
• Does the EmsClientCert certificate have the correct usage identifiers in place? Does it have the private key present?
• Does the eEyeEmsCA exist on both the agent and the server? Make sure the certificate on the agent has the same serial number as the certificate on the BeyondInsight server. To view the serial number, double-click the certificate in the certificate manager.
• Was the eEyeEmsCA certificate regenerated or removed? Regenerating or removing the eEyeEmsCA certificate invalidates any certificate that was generated using the old CA certificate. This breaks the communication between the agents and the server until the client and server certificates are regenerated on the server and the new client certificate is deployed on all agents connecting to BeyondInsight.
• Did the Central Policy password change? If you change the Central Policy password using the BeyondInsight Configuration Tool, the password change is not automatically applied to EmsClientCert.pfx.

Use a domain PKI for BeyondInsight communication

If you choose to create a custom certificate, keep in mind the following considerations:

• You can modify templates using the Certificate Templates Console (certtmpl.msc).
• The default Computer template meets the requirements for BeyondInsight communication. However, to update any particular BeyondInsight configuration settings, you must copy the Computer template and make your changes in the copy.
• To issue the new template, use the certsrv.msc snap-in.

ℹ️

Note

For detailed procedures on creating a custom domain certificate, see Microsoft's documentation.

Prerequisites

• Domain member server with Active Directory Certificate Services installed and configured.
• Certificate Authority Web Enrollment role installed

Requirements

• The certificates must be configured as Server Authentication and Client Authentication in the Intended Purposes section of the certificate.
• The Subject key must contain common text for all client certificates.

Assign the SSL Web Service certificate in BeyondInsight

1. Start the BeyondInsight Configuration Tool.
2. Scroll to Web Service in the list.
3. Select the domain PKI certificate from the list.
4. Click Apply.

Configure a client certificate for Privilege Management for Desktops

1. In Group Policy Management Editor, edit the group policy you use for your Privilege Management for Desktops targets.
2. Go to Administrative Templates > BeyondTrust > Privilege Management for Desktops > System > Management.
3. Double-click the setting Configure the BeyondInsight Certificate Name.
4. Enter the common text you used in the client certificate Subject key.

Configure auto enrollment

1. In Group Policy Management Editor, edit the group policy you use for your Privilege Management for Desktops targets.
2. Go to Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Automatic Certificate Request Settings.
3. Right-click within the right pane and select New > Automatic Certificate Request.
4. Go through the wizard. On the Certificate Template page, select the custom template.

Configure BeyondTrust Discovery Scanner connections to BeyondInsight

The BeyondTrust Discovery Agent is a service that is packaged with BeyondInsight. By default, it runs on the appliance where BeyondInsight is installed, or in the case of a cloud instance, it runs where your resource brokers are deployed.

For on-premises deployments, the discovery agent can also be installed separately on a standalone Windows system and configured to communicate with BeyondInsight on your U-Series Appliance. This increases scanning capacity and is helpful in environments that have a large number of hosts.

Once the BeyondTrust Discovery Scanner and the console are installed, they must be configured to work together by configuring both Central Policy and Events Client.

Configure BeyondInsight Analytics & Reporting

Before you can use Analytics & Reporting, make sure that SQL Analysis Services, SQL Reporting and Integration Services, and SQL Report Server are installed and working.

⚠️

Important

Analytics & Reporting is not supported on an external SQL Server, because the replication of the credentials of the BeyondTrust Admin account presents a security threat to the host. Analytics & Reporting is supported only on the main console node.

Assign permissions for Analytics & Reporting

In many cases, an account with local admin or domain admin privileges will suffice. However, in some more advanced deployments, you may desire to assign more specific permissions to installation and user accounts.

Installation user permissions

When installing Analytics & Reporting, the user account requires SQL Server database access. Ideally, assign the account the sysadmin server role. Otherwise, make sure at least the following SQL Server permissions are assigned to the account.

Configuration user permissions

The configuration user is the account entered on the Installation Credentials page of the configuration wizard. This account requires:

• Local administrator rights to SQL Analysis Services so they can deploy the Analysis Services cube
• Permission to create a registry key under HKEY_LOCAL_MACHINE\SOFTWARE\EEYE
• The Log on as Batch Job security policy on the SQL Server

Web proxy user permissions

The web proxy user is the account entered on the Web Service Credentials page of the Configuration Wizard.

ℹ️

Note

These permissions are automatically set up during installation if the installing user has sufficient rights.

SSRS proxy user permissions

The SSRS proxy user is the account entered on the SQL Reporting Services (SSRS) page of the Configuration Wizard.

ℹ️

Note

These permissions are automatically set up during installation if the installing user has sufficient rights.

SQL agent service permissions

This account runs the daily sync job and requires permission to process the BeyondInsight SSAS database.

Verify SQL Report Server functionality

1. To verify that SQL Report Server works properly:
   • In Windows 2016 or later, click Start > Apps > Microsoft SQL Server 20xx > SQL Server 20xx Reporting Services Configuration Manager.
2. After connecting, select Web Service URL.
3. Under Report Server Web Service URL, click the link and verify the confirmation web page.)
4. Select Report Manager URL.
5. Under Remote Manager Site Identification, click the link and verify the confirmation web page.

Configure Analytics & Reporting

ℹ️

Note

Be careful not to refresh the browser during this process, because doing so reloads the page, requiring you to log in again.

1. Log in to the BeyondInsight management console, and then click Configuration in the left menu.
2. In the Analytics & Reporting tile, click Configuration.
3. Re-enter the administrative credentials used to log in to the console.
4. Click Configure Now.
5. On the Installation Credentials page, enter the local or domain administrator credentials.
6. On the SQL Server and SQL Server Analysis Services page, enter the database name.
7. On the SQL Server Reporting Services page, enter the web service URL in the format:
8. http://:80/ReportServer.
9. On the SQL Server Agent page, set a job run time, and then enter an administrative username and password to use as a proxy.

ℹ️

Note

You cannot leave this field blank, as the default SQL Server Agent service account created during SQL Server installation does not have the necessary write permissions to the BeyondInsight Reporting database.

10. On the Web Services Credentials page, the username and password automatically populate. Click Deploy.

11. Deployment progress is shown while the BeyondInsight Reporting database is created. When database creation is complete, click Finish.

12. Once the deployment completes, select the option to synchronize data. This critical process reads the database created during management console configuration. It finds the scan results and synchronizes them with the newly created Reporting database.

    By default, synchronization occurs every day at 12:00 AM unless otherwise specified in the SQL Server Agent settings. You can also run the synchronization manually. Synchronization takes several minutes to complete.

13. Verify successful synchronization by clicking the SQL Server Agent Jobs tab and then clicking Refresh.

ℹ️

Note

For more information on the permissions needed to install and use Analytics & Reporting, see Analytics & Reporting.

Configure Privilege Management for Unix & Linux

You can use BeyondInsight to manage Privilege Management for Unix & Linux event logs. Configure BeyondInsight and Privilege Management for Unix & Linux to work together to send event logs to the BeyondInsight management console.

Requirements

• BeyondInsight 4.5 or later
• Privilege Management for Unix & Linux 7.5 or later

Generate a certificate

1. Open the BeyondInsight Configuration Tool and select Certificate Management.
2. Select Export certificate.
3. Select Client certificate.
4. Enter a password for the export file and provide the destination in the Path field.
5. Click OK to export the certificate as a PKCS#12 file (with a .pfx extension).
6. Using BeyondTrust FIPS Object Module for OpenSSL, convert the certificate from PKCS#12 (*.pfx) to PEM (*.pem):

   openssl pkcs12 -clcerts -in <full path of pfx> -out <full path of target pem> -nodes
   

7. Securely copy the certificate to the Privilege Management for Unix & Linux policy and log server hosts.
8. In the settings file, assign the path and file name of this certificate to the keyword sslrcscertfile.

Export the BeyondInsight server SSL certificate

1. Open the Windows Certificate Manager (certmgr.msc) and expand the Trusted Root Certification Authorities folder.
2. In the details pane, select the BeyondInsight server SSL certificate from the Issued To field.
3. The certificate name contains the host name of the BeyondInsight server and the text eEye EMS CA.

✅

Example

• RCS host name: LA-HOST-01
• Certificate name: LA-HOST-01 eEye EMS CA

4. From the Action menu, select All Tasks > Export.
5. In the Certificate Export Wizard:
   • Select No when asked to export the private key, and then click Next.
   • Select the DER-encoded binary X.509 (*.CER) format, and then click Next.
   • Provide the target destination of the certificate, and then click Next.
   • Confirm the settings, and then click Finish to export the certificate.
6. Using BeyondTrust FIPS Object Module for OpenSSL, convert the certificate from DER (*.der) to PEM (*.pem):

   openssl x509 -inform der -in <full path of der> -out <full path of target pem>
   

7. Securely copy the certificate to the Privilege Management for Unix & Linux policy and log server hosts.
8. In the settings file, assign the path and file name of this certificate to the keyword sslrcscafile.

Configure keywords

If you have not already done so during installation of Privilege Management for Unix & Linux, set the following keywords in pb.settings on the policy and log server hosts:

• rcshost
• rcswebsvcport
• sslrcscertfile
• sslrcscafile
• rcseventstorefile

Configure Endpoint Privilege Management

You can configure Privilege Management for Desktops to forward events to BeyondInsight. Before proceeding, make sure you have the appropriate license key for BeyondInsight and that you have installed all components for Privilege Management for Desktops and for BeyondInsight.

Generate a certificate

Generate a client certificate using the BeyondInsight Configuration Tool. A certificate must be deployed to any asset where you capture events with Privilege Management for Desktops.

After you have generated a certificate, you can create an MSI certificate installation file. You can then set up a group policy with the MSI file and deploy the certificate to your Privilege Management for Desktops assets.

ℹ️

Note

Do not generate a client certificate if one has already been created for BeyondTrust Discovery Scanner. You can use the existing client certificate for your Privilege Management for Desktops assets.

ℹ️

Note

Any Privilege Management for Desktops asset to which the MSI is deployed via group policy must have the .NET Framework 4.7.2 prerequisite installed.

1. Open the BeyondInsight Configuration Tool and select Certificate Management.
2. Select Generate Certificate.
3. Select Client Certificate.
4. Enter a password.
5. Click OK.

Create an MSI file

1. Run the BeyondInsight Configuration Tool.
2. Click Generate Certificate MSI.
3. The certinstaller.msi is created in C:\Program Files (x86)\eEye Digital Security\Retina CS\Utilities\msi.

Configure Privilege Management for Desktops

1. Install the Privilege Management for Desktops components.
2. Run the Group Policy Management Editor.
3. Go to the Management folder in the Administrative Templates section.
4. Set the following options.

Configure AD Bridge to Forward Events to BeyondInsight

You can configure AD Bridge to forward events to BeyondInsight. Before proceeding, make sure you have the appropriate license key for BeyondInsight and that you have installed all components for AD Bridge and BeyondInsight.

Generate a certificate

1. Open the BeyondInsight Configuration Tool and select Certificate Management.
2. Select Generate Certificate.
3. Select Client Certificate.
4. Enter a password.
5. Click OK.

Configure AD Bridge

1. On the AD Bridge server, run the DBUtilities tool.
2. Check the Enable BeyondInsight box.
3. Enter the URL to the BeyondInsight server.
4. Enter the name of the client certificate generated earlier.
5. Optionally, create a workgroup name. A workgroup name can be used as a unique identifier.
6. Check the Validate client certificate box.
7. Click Test Connection to ensure the connection between the servers works properly.

Use the BeyondInsight Configuration Tool

After your initial configuration of BeyondInsight, you can modify settings and configure additional settings using the BeyondInsight Configuration Tool.

Change the access URL

The default URL to access the BeyondInsight website is https:///WebConsole. To change the default URL:

1. On the BeyondInsight server, go to Start > All Programs > BeyondTrust > BeyondInsight > BeyondInsight Configuration.
2. Scroll to Web Site Information.
3. Change the URL, making sure the address starts with https://.
4. Click Apply.

IIS App Pool Idle Timeout

Set the Internet Information Service (IIS) Application Pool Idle Timeout to a maximum of 60 minutes, with a default timeout set to 20 minutes. To change this timeout:

1. On the BeyondInsight server, select Start > All Programs > BeyondTrust > BeyondInsight > BeyondInsight Configuration.
2. Scroll to Web Site Information.
3. Change the session timeout value.
4. Click Apply.

Manage Your BeyondInsight License

Online activation

Use the BeyondInsight Configuration Tool to update your license. You must upgrade your license to extend your maintenance or to apply a purchased asset count (for example, 500 assets to 1,000 assets).

1. On the server hosting BeyondInsight, go to Start > All Programs > BeyondTrust > BeyondInsight > BeyondInsight Configuration.
2. Click Manage License.
3. On the License Management page, select Update License.
4. Click Next.
5. Click Finish.
6. Click Apply to close the BeyondInsight Configuration Tool.

ℹ️

Note

After your license key expires, you can continue to log in to the console. However, product updates are no longer provided.

Offline activation - U-Series Appliance only

If internet access is not available, you can generate a license key offline.

To activate the license offline:

1. On the server hosting BeyondInsight, go to Start > All Programs > BeyondTrust > BeyondInsight > BeyondInsight Configuration.
2. Click Manage License.
3. Enter the BeyondInsight license key (serial number) provided by BeyondTrust in the Serial Number box on the license management utility.
4. Click Next. This step fails because there is no Internet access.
5. Access a machine that has Internet access and browse to the offline licensing form: https://licensing.beyondtrust.com.
6. Submit the BeyondInsight license key (serial number) provided to you by BeyondTrust and used during the install process and on the first step of the license management utility.
7. Copy the license key generated for your instance of BeyondInsight.
8. Return to the offline system license management utility and click Next to get to the page requesting a license key.
9. Insert the license key that you obtained from the offline licensing form result.
10. Click Next to complete the offline registration process.
11. Click Finish to close the license management utility.

Repeat these steps for all U-Series Appliances in your deployment.

Windows Authentication to the Database

As a security best practice for PCI DSS compliance, use Windows authentication for database access.

Change database authentication

You can set up Windows authentication on your SQL Server database.

1. Log in to SQL Server.
2. Create a SQL Server login, such as Domain\RemoteServerName$.
3. Go to the properties for the new login, and create a user mapping to the BeyondInsight database and the REM3Admins role.

Upgrade the BeyondInsight Software

Download the installation package

Download the appropriate installer by logging into the BeyondTrust Support Portal.

ℹ️

Note

You must have a BeyondTrust Support account to log in to the Support Portal.

Backup the BeyondInsight database

ℹ️

Note

Prior to upgrading, BeyondTrust strongly recommends that you create a backup of your BeyondInsight database in SQL Management Studio.

1. Open SQL Management Studio.
2. In Object Explorer, navigate to your BeyondInsight database.
3. Right-click the database name, and then select Tasks > Back Up ...
4. Choose a location to store the backup of your database.

Run the installer

1. Double-click the installer EXE or MSI file.
2. In upgrade scenarios, the Serial Number field auto-populates with your BeyondInsight serial number. Click Continue.

ℹ️

Note

BeyondInsight 7.0 and later releases do not include support for a number of features. These are listed in the installer on the first step. Proceeding with the installation, in upgrade situations, removes your ability to access the particular functions listed here. You may contact BeyondTrust Support to obtain the Flash SWF files to restore these functions, but this is a manual process.

3. Verify the Destination Folder where BeyondInsight is installed, and then click Continue to begin the upgrade.

⚠️

Important

Selecting a destination folder other than the folder where BeyondInsight is installed will cause the upgrade to fail.

4. Click Install
5. When the upgrade installation is complete, click Finish.

Run the Analytics & Reporting configuration wizard

After the system reboots, the Reporting Services components must be updated.

1. Open BeyondInsight and navigate to Configuration > Analytics & Reporting.
2. Click the Launch Configuration Wizard button.
3. In upgrade scenarios, the Username and Password fields are auto-populated.

ℹ️

Note

The user credentials must have the appropriate rights to deploy to SQL Server, Analysis Services, Integration Services, and to configure the BeyondInsight website settings.

4. Click Deployment. Upgrades to the Reporting Services components are installed automatically. A status bar at the bottom left shows the progress.
5. When the installation completes, click the Synchronize Data Now button to start the data sync, or you can wait for the synchronization to occur as scheduled.
6. When the synchronization has started, BeyondInsight displays a link to the Configuration Panel.
7. Click the Configuration Panel link to view the SQL Server Agent Jobs tab, with the synchronization job status listed.