Required Connectivity, Proxies, and Certificates for Agents

URLs

Allowlist the following URLs to enable the agent to communicate with the Lacework platform:

Expand to View

packages.lacework.net (for installing the Linux agent)
updates.lacework.net : TCP/443 (for upgrading the Linux and Windows agents)
agent.lacework.net : TCP/443
api.lacework.net : TCP/443 (for US accounts)
aprodus2.agent.lacework.net : TCP/443 (for US accounts)
agent.gprodus1.lacework.net (for US accounts)
api.fra.lacework.net : TCP/443 (for EMEA accounts)
auprodn1.agent.lacework.net : TCP/443 (for ANZ accounts)
ec2.*.amazonaws.com and organizations.*.amazonaws.com (for retrieving metadata tags from AWS resources)
https://compute.googleapis.com (for retrieving metadata labels from Google Cloud resources)
agentcheck.lacework.net
agentcheck.lacework.dev
agent.certprobe.lacework.net

note

Agents connect to agentcheck.lacework.net, agentcheck.lacework.dev, and agent.certprobe.lacework.net to enable Lacework to monitor agent connectivity with the Lacework platform. Lacework will notify you if an agent has connectivity issues.

IP Addresses

Alternatively, If you cannot use URLs for rule writing, allowlist the following IP addresses:

Expand to View

api.lacework.net resolves to the following rotating IPs:

209.102.252
212.241.15
212.79.17
164.176.181
225.189.230
230.246.102
35.54.98
43.136.187
185.31.7
159.137.89
159.138.89
100.6.0/23

aprodus2.agent.lacework.net resolves to the following rotating IP addresses:
```
162.159.137.89
162.159.138.89
168.100.6.0/23
```

api.fra.lacework.net resolves to the following rotating IP addresses:

auprodn1.agent.lacework.net resolves to the following IP addresses:
```
162.159.137.89
162.159.138.89
168.100.6.0/23
```
agent.gprodus1.lacework.net resolves to the following IP addresses:
```
162.159.137.89
162.159.138.89
168.100.6.0/23
```

If required, the agent can be configured to use a network proxy by adding proxy information to the config.json agent configuration file or by setting the https_proxy environment variable.

Proxies

To include proxy information, edit the proxyurl key in the config.json file:

{
  "proxyurl": "http://Your_Proxy_Server:Your_Port"
}

Or if your proxy requires a password:

{
  "proxyurl": "http://username:password@Your_Proxy_Server:Your_Port"
}

Add Proxy Information for Kubernetes

To include proxy information in a Kubernetes ConfigMap, you can use the same definition of a proxy as above, as illustrated in this sample lacework-cfg-k8s.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: lacework-config
data:
  config.json: |
    {"tokens":{"AccessToken":"${LaceworkAccessToken}"}, "proxyurl":"http://Your_Proxy_Server:Your_Port"}

Set the https_proxy Environment Variable

From the shell on the host on which you want to install the agent, use the following command to add your proxy URL using the https_proxy environment variable.

note

This environment variable must be set before you install the agent. If you set the environment variable after you install the agent, it will not be able to read the proxy settings and can fail to communicate with the Lacework platform.

export https_proxy="http:Your_Proxy_Server:Your_Port"

Or if your proxy requires a password:

export https_proxy="http://username:password@Your_Proxy_Server:Your_Port"

Add a Certificate

This section describes the certificates required for the Lacework clouds. If a certificate is not present in the trust store, the agent will not be able to communicate with the Lacework platform. Most current operating systems include the required certificate by default. In certain older operating systems, you might need to add it explicitly.

Certificate for the US Cloud

The api.lacework.net US cloud supports the following Google Trust Services (GTS) Root R1 and GoDaddy certificates.

Google Trust Services (GTS) Root R1 Certificate

The GTS Root R1 certificate is as follows:

Expand to View

GoDaddy Certificate

The GoDaddy certificate is as follows:

Expand to View

Certificate for the GPRODUS1, APRODUS2, ANZ, and EU Cloud

For the APRODUS2, ANZ, and EU cloud, Lacework supports the following Google Trust Services (GTS) Root R1 and Digicert Baltimore CyberTrust Root certificates.

For the GPRODUS1 cloud, Lacework supports the following Google Trust Services (GTS) Root R1 certificate.

Google Trust Services (GTS) Root R1 Certificate

The GTS Root R1 certificate is as follows:

Expand to View

Digicert Baltimore CyberTrust Root Certificate

The Digicert Baltimore CyberTrust Root Certificate is as follows:

Expand to View

URLs​

IP Addresses​

Proxies​

Add Proxy Information for Kubernetes​

Set the https_proxy Environment Variable​

Add a Certificate​

Certificate for the US Cloud​

Google Trust Services (GTS) Root R1 Certificate​

GoDaddy Certificate​

Certificate for the GPRODUS1, APRODUS2, ANZ, and EU Cloud​

Google Trust Services (GTS) Root R1 Certificate​

Digicert Baltimore CyberTrust Root Certificate​

URLs

IP Addresses

Proxies

Add Proxy Information for Kubernetes

Set the https_proxy Environment Variable

Add a Certificate

Certificate for the US Cloud

Google Trust Services (GTS) Root R1 Certificate

GoDaddy Certificate

Certificate for the GPRODUS1, APRODUS2, ANZ, and EU Cloud

Google Trust Services (GTS) Root R1 Certificate

Digicert Baltimore CyberTrust Root Certificate