1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Install
    6. Install Defender
    7. Install a single Container Defender

    Install a single Container Defender

    Install Container Defender on each host that you want Prisma Cloud to protect.
    Single Container Defenders can be configured in the Console UI, and then deployed with a curl-bash script. Alternatively, you can use twistcli to configure and deploy Defender directly on a host.

    Install a single Container Defender (Console UI)

    Configure how a single Container Defender will be installed, and then install it with the resulting curl-bash script.
    Prerequisites
    :
    • Your system meets all minimum system requirements.
    • You have already installed Console.
    • Port 8083 is open on the host where Console runs. Port 8083 serves the API. Port 8083 is the default setting, but it is customizable when first installing Console. When deploying Defender you can configure it to communicate to Console via a proxy.
    • Port 8084 is open on the host where Console runs. Console and Defender communicate with each other over a web socket on port 8084. Defender initiates the connection. Port 8084 is the default setting, but it is customizable when first installing Console. Defender can also be configured to communicate to Console via a proxy.
    • Console can be accessed over the network from the host where you want to install Defender.
    • You have sudo access to the host where Defender will be installed.
    1. Verify that the host machine where you install Defender can connect to Console.
      $ curl -sk -D - https://<CONSOLE_IP_ADDRESS|HOSTNAME>:8083/api/v1/_ping
      If curl returns an HTTP response status code of 200, you have connectivity to Console. If you customized the setup when you installed Console, you might need to specify a different port.
    2. Log into Console.
    3. Go to
      Manage > Defenders > Deploy
      .
      1. In the first drop-down menu (2), select the way Defender connects to Console.
        A list of IP addresses and hostnames are pre-populated in the drop-down list. If none of the items are valid, go to
        Manage > Defenders > Names
        , and add a new Subject Alternative Name (SAN) to Console’s certificate. After adding a SAN, your IP address or hostname will be available in the drop-down list.
        Selecting an IP address in a evaluation setup is acceptable, but using a DNS name is more resilient. If you select Console’s IP address, and Console’s IP address changes, your Defenders will no longer be able to communicate with Console.
      2. (Optional) Set a p