Offline Activation and Plugin Updates

Offline Activation

To activate Log Correlation Engine and update Log Correlation Engine plugins on an air-gapped network:

1. Obtain your Log Correlation Engine activation code from the Tenable Community site, as described in the Tenable Community Guide.

2. Copy the activation code to be used with the offline Log Correlation Engine server.

3. Log in to the offline Log Correlation Engine terminal as the root user.

4. In the CLI in Log Correlation Engine, tun the following command:

   # /opt/lce/daemons/lce_wwwd --challenge

   Challenge:

      e1e02d38a48603467fb8728b13ada3e29e5e9fd4

   Copy the challenge above and paste it (with your Activation Code) into:

      https://plugins.nessus.org/v2/offline-lce.php

5. Copy the challenge code to be used with the offline Log Correlation Engine server.

6. Go to https://plugins.nessus.org/v2/offline-lce.php and enter the activation code and challenge code obtained in the previous steps.

7. Select the generated link to download the current plugin set. Make a copy of the link that is returned. The link provided will be valid until the Log Correlation Engine subscription expires.

8. Save the link, as it will be needed each time the plugins are manually updated.

9. Select the link to download the license key, lce.license, or create an lce.license file by copying the license into a text file from -----BEGIN TENABLE LICENSE----- to -----END TENABLE LICENSE-----.

10. On the Log Correlation Engine server host, copy the lce.license file to /opt/lce/daemons, and run the following command:

    # /opt/lce/daemons/lce_wwwd --register-offline lce.license

11. Go to https://<ip address of your lce>:8836 and complete the Quick Setup.

12. To verify the license has been loaded successfully, on the top navigation bar, click Health and Status.

13. On the left pane, click Plugins.

    The Activation Status should be Licensed.

Offline Plugin Updates

Before you begin:

• Complete step 5 of the Offline Activation procedure to obtain a link download the latest lce-combined.tar.gz file.

  You will use this link to obtain the latest plugins for the duration of your Log Correlation Engine subscription. The lce-combined.tar.gz file contains updates for Log Correlation Engine PRM(s), TASL(s), discoveries, client policies, the web client, and the web server.

To perform an offline plugin update:

1. Download the latest lce-combined.tar.gz file.

2. Log in to the Log Correlation Engine interface (https://<ip address of your lce>:8836).

3. Click Configuration on the top navigation bar.

   The Configuration page appears, displaying the Basic section.

4. Click Feed Settings on the left pane.

   The Feed Settings section appears.

5. Under Offline Plugin Update, click the Add Plugins button, and then select the lce-combined.tar.gz file you downloaded in step 1.

6. After the file is successfully uploaded, click the Process Plugins button. The process may take a short time to complete.

7. To verify the plugins have been successfully loaded, on the top navigation bar, click Health and Status, and then, on the left pane, click Feed. The Plugin Set and the Plugin Set Loaded should now reflect the latest set of plugins. For example, a value of 201907222231 is interpreted as 2019-07-22 22:31.