Install a single Container Defender
Single Container Defenders are installed with a curl-bash script.
Install Container Defender on each host that you want Prisma Cloud to protect.
Prerequisites
:- Your system meets all minimum system requirements.
- You have already installed Console, and it can be accessed over the network from the host where you want to install Defender.
- Ports 8083 and 8084 are open on the host where Console runs.
- Port 8084 is open on the host where Defender runs. Console and Defender communicate with each other over a web socket on port 8084 (by default the communication port is set to 8084 - however, you can specify your own custom port when deploying a Defender).
- You have sudo access to the host where Defender will be installed.
- Verify that the host machine where you install Defender can connect to Console.$ curl -sk -D - https://<CONSOLE_IP_ADDRESS|HOSTNAME>:8083/api/v1/_pingIf curl returns an HTTP response status code of 200, you have connectivity to Console. If you customized the setup when you installed Console, you might need to specify a different port.Log into Console.Go toManage > Defenders > Deploy.
- In the first drop-down menu (2), select the way Defender connects to Console.A list of IP addresses and hostnames are pre-populated in the drop-down list. If none of the items are valid, go toManage > Defenders > Names, and add a new Subject Alternative Name (SAN) to Console’s certificate. After adding a SAN, your IP address or hostname will be available in the drop-down list.Selecting an IP address in a evaluation setup is acceptable, but using a DNS name is more resilient. If you select Console’s IP address, and Console’s IP address changes, your Defenders will no longer be able to communicate with Console.
- (Optional) Set a proxy (3) for the Defender to use for the communication with the Console.
- (Optional) Set a custom communication port (4) for the Defender to use.
- In the second drop-down list (5), select the Defender type. Both Linux and Windows platforms are supported.
- In the second drop-down list (5), select the Defender type. Both Linux and Windows platforms are supported.
- In the third drop-down list (6), leave the listener type set toNone.
- In the final field (7), copy the install command, which is generated according to the options you selected.
On the host where you want to install Defender, paste the command into a shell window, and run it.Verify the installVerify that Defender is installed and connected to Console.Defender can be deployed and run with full functionality when dockerd is configured with SELinux enabled (--selinux-enabled=true). All features will work normally and without any additional configuration steps required. Prisma Cloud automatically detects the SELinux configuration on a per-host basis and self-configures itself as needed. No action is needed from the user.- In Console, go toManage > Defenders > Manage.Your new Defender should be listed in the table, and the status box should be green and checked.
