How Do I Get Orbital?

You can only get Orbital with the purchase of products in the Cisco security portfolio.

Orbital is available for customers with Secure Endpoint Advantage.

Orbital allows you to query endpoints for detailed information wherever you have Orbital deployed. Secure Endpoint Advantage customers can deploy Orbital automatically if your endpoints already have a Connector installed. See the Secure Endpoint Console Secure Endpoint Console Help for the most current Connector version and other important information.

Orbital is bundled with the Secure Endpoints Connector package for both Windows and macOS. The Connector will deploy Orbital when you enable it in a policy.

Enable Orbital

If your endpoints already have a connector installed, you can simply enable Orbital in an existing Secure Endpoint policy for your endpoints. To enable Orbital:

  1. Go to the Secure Endpoint Console.

  2. Click Management -> Policies

    3. The Policies page should open.

  3. Expand an Orbital policy.

  4. Click the Edit.

    5. The Edit Policy page should open.

  5. Under Advanced Settings select Orbital, and verify that Orbital enabled.

  6. To ensure that Orbital is enabled:

  • Check that the Enable Orbital Advanced Search check box is selected.

OR

  • Select the check box to enable Orbital.

Note: If you disable Orbital in the Policies page it will disable the service but will not uninstall it. Enabling it again will restart the service.

How to Set Up Orbital with Secure Endpoint

The Orbital endpoint agent (node) is automatically downloaded and installed when you enable Orbital in your Secure Endpoint policy. Ideally you will not have to download anything, but simply enable Orbital for your existing endpoints. If necessary you can download a Secure Endpoint Connector from the Secure Endpoint Console.

You can enable Orbital for any existing policy. For example, if you have 1000 computers in your Protect group, simply enable Orbital on that policy and it should be dropped to your 1000 computers automatically.

If you want to use Orbital on a specific group of endpoints, for example, then create a new policy and group for this purpose. See the Secure Endpoint Console Help for detailed information.

Note: You can also access Orbital directly at https://orbital.amp.cisco.com.

Orbital is included with your Cisco XDR (all tiers). To deploy Orbital via Secure Client:

  1. Log in to the Cisco XDR console.

  2. Confirm you have an Orbital integration module configured by navigating to Administration -> Integrations and expanding the My Integrations section. If an Orbital integration is not present, add one by finding Orbital under:

    • Cisco Integrations > Get Started > Add.

  3. Navigate to Client Management > Deployments.

  4. Click Create New on the Deployment page.

  5. Select the operating system and architecture for the deployment, then click Create New..

  6. Configure the deployment to enable the Orbital module and select the desired installation version.

  7. Save the deployment.

  8. Download the full or network installer and execute it on the target endpoint.

  9. Log in to the Orbital console to perform Orbital queries and run scripts against the endpoint after the Orbital module installs successfully.

Note: If you have a Secure Endpoint license, deploying Orbital via Secure Endpoint is recommended to maintain Forensic Snapshot integration between the two products. To preserve this integration, you cannot configure and save a Secure Client deployment containing both Secure Endpoint and Orbital modules. For more details on deploying Orbital via Secure Endpoint, see the Secure Endpoint section.
Note: Currently, you cannot target the Orbital node using the Cloud Management ID (CMID).

More Info