Usage

• 1: Login to PPC
• 1.1: Prerequisites
• 1.2: Log in to PPC
• 1.3: Overview of the UI
• 2: Accessing PPC using a Linux machine

1 - Login to PPC

1.1 - Prerequisites

Use Route 53 configuration on AWS to resolve the PPC FQDN specified during the installation to the internal load balancer.

• Ensure that the instance is using the AWS-provided DNS server, such as, VPC CIDR + 2.
• Verify that enableDnsHostnames and enableDnsSupport are set to true in the VPC settings.
• Verify the Security Group of the load balancer. Ensure that Inbound traffic is allowed on the required ports, such as 80 and 443, from the client instance’s IP or Security Group.
• Keep the following information ready:
  • VPC ID: The ID of the VPC for the client instances and the Load Balancer. For example, vpc-0123456789.
  • Internal ELB DNS Name: The DNS name of the load balancer. For example, internal-abcdefghi123456-123456789.us-east-1.amazonaws.com.
  • Target FQDN: The FQDN for PPC. For example, mysite.aws.com.

1. Find the AWS Load Balancer address.

    kubectl get gateway -A

The output appears similar to the following:

    NAMESPACE     NAME       CLASS   ADDRESS                                                                         PROGRAMMED   AGE
    api-gateway   pty-main   envoy   a814fae40464d462da9ca685921699c0-1ccfcf98919adf90.elb.us-east-1.amazonaws.com   True         34m

2. Verify that the gateway address resolves to an internal IP, using the following command:

    ping <gateway_address>

Where <gateway_address> is the ADDRESS value from the previous step.

The output confirms that the hostname resolves to a private VPC IP address (10.x.x.x range), indicating the load balancer is internal and accessible only within the AWS VPC.

The output appears similar to the following:

    PING a814fae40464d462da9ca685921699c0-1ccfcf98919adf90.elb.us-east-1.amazonaws.com (10.31.4.172) 56(84) bytes of data.

3. Map the PPC FQDN to the load balancer using Route 53.

For more information about configuring Route 53, refer to the AWS documentation.

1.2 - Log in to PPC

Access the PPC using the FQDN provided during the installation process.

https://<cluster-FQDN>

Enter the following parameters to log in and view the homepage.

• Username: Application username
• Password: Application password

For more information about the default credentials, refer to the Release Notes.

Note: When logging in for the first time, ensure to use the application username and password.
If the password is changed using the CLI Manager, then use the updated credentials to log in to the Web UI.

Reset default credentials

If logging in to the PPC for the first instance, then the Reset your temporary password screen appears.

Ensure that the password must contain the following:

• Minimum of 14 characters.
• At least 1 uppercase character.
• At least 1 lowercase character.
• At least 1 digit.
• At least 1 special character.
• Cannot reuse any of the last 5 passwords.

Perform the following steps to reset the temporary password:

1. Log in to the Web UI using the FQDN of the cluster.
   https://<cluster-FQDN>
2. Enter username and temporary password. Click Sign In.
   The Reset your temporary password screen appears.
3. Enter the temporary password, in Current Password field.
4. Enter new password, in New Password.
5. Re-enter the new password, in Confirm New Password.
6. Click Reset Password.

After the password is reset successfully, the home page appears.
To return to the login screen without resetting the password, click Back to Login.

1.3 - Overview of the UI

Overview of the UI

After logging in, the UI is organized into the following main areas:

• Top banner: Displays the Protegrity logo, the Home button that returns you to the homepage, and the user menu badge at the upper-right corner. The badge shows the initials of the logged-in user. It provides access to your profile, appearance settings, and the sign out option.
• Navigation pane: Appears on the left and groups the product capabilities into the following sections:
  • Discover: Provides access to Sources and Classifications.
  • Policy: Provides access to Data, AI, and Policy Library.
  • Insight: Opens the dashboards used to monitor protection and policy coverage.
• Content area: Displays the page that corresponds to the item selected in the navigation pane.

Working with the Home Page

The home page welcomes the logged-in user and presents The Path to Protection. It is a guided workflow that helps you discover sensitive data, create policy, and continuously improve protection through Insight.

The workflow is organized into the following three stages:

1. Discover - Define and Scan: Define what matters by reviewing built-in classifiers and adding custom classifications. Start with a focused scope by connecting related data and identity sources. Keep discovery current by scheduling recurring scans.
2. Policy - Create and Deploy: Create data policies to define how discovered data classifications are protected. Create AI policies to set protection and access expectations for AI agents and applications. Review and deploy to activate the controls.
3. Insight - Ensure and Improve: Run a health check to assess protection and policy coverage. Troubleshoot to identify coverage gaps. Measure to tune classifiers and policy over time.

Note: The items displayed on the home page vary depending on the features configured in the PPC.

Working with the Profile

The Profile Settings page lets you manage your profile, security, and API access.

To open the Profile Settings page:

1. Click the user menu badge at the upper-right corner of the top banner. The badge displays the initials of the logged-in user.
2. From the menu, click Profile. The Profile Settings page appears.

The Profile Settings page is organized into the following sections:

• Profile: View and update your first name, last name, and email address.
• Password: Update your account password.
• API Token: View, copy, and regenerate your API token.
• Permissions: View the permissions assigned to your account.

Updating Profile Information

Perform the following steps to update your profile information:

1. On the Profile Settings page, go to the Profile section.
2. Update the First Name, Last Name, or Email Address fields, as required.
3. Click Save Changes.

Note: The Save Changes button is enabled only after you modify at least one field.

Updating the Password

Perform the following steps to update your password:

1. On the Profile Settings page, go to the Password section.
2. Enter your existing password in the Current Password field.
3. Enter the new password in the New Password field.
4. Re-enter the new password in the Confirm New Password field.
5. Click Update Password.

Note: Ensure that the new password meets the password policy requirements described in the Reset default credentials section.

Working with the API Token

The API Token section lets you manage the API token used to authenticate programmatic access. The token is masked by default.

The following options are available:

• Show token: Reveals the masked token.
• Copy token to clipboard: Copies the token so that you can use it in your applications.
• Generate new token: Generates a new API token. The previously issued token is no longer valid after a new token is generated.

Viewing Profile Permissions

The Permissions section displays the list of permissions assigned to your account. This section is Read-only and cannot be modified from the Profile Settings page.

Switching Modes

You can switch between the Light and Dark mode from the user menu.

Perform the following steps to switch the appearance mode:

1. Click the user menu badge at the upper-right corner of the top banner.
2. Under Appearance, select Light or Dark. The UI immediately applies the selected mode.

Logging Out

Perform the following steps to log out of the UI:

1. Click the user menu badge at the upper-right corner of the top banner.
2. Click Sign Out. You are logged out and the login screen appears.

2 - Accessing PPC using a Linux machine

Access to the PPC cluster from a separate Linux machine may be required in the following situations:

• The original jump box used during installation is no longer available or has been decommissioned.
• A different team member or administrator needs cluster access without setting up a new jump box.
• Operational tasks, such as troubleshooting or monitoring, are being performed from a dedicated management machine.
• The organization requires cluster access to be restricted to specific machines for security or compliance reasons.

Before you begin

Ensure that the following prerequisites are met.

• A Linux machine is available and running.
• AWS CLI is installed and configured.
• Kubernetes command-line tool is installed.

Perform the following steps to access PPC using a separate Linux machine.

1. Log in to Linux machine with root credentials.

2. Configure AWS credentials, using the following command:

   aws configure
   

3. Verify that AWS credentials are working, using the following command:

   aws sts get-caller-identity
   

4. If the Kubernetes command-line tool is not available, then install the Kubernetes command-line tool, using the following command:

   kubectl version --client 2>/dev/null || {
    echo "Installing kubectl..."
    curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
    chmod +x kubectl
    sudo mv kubectl /usr/local/bin/
    kubectl version --client
   }
   

5. Set up the Kubernetes command-line tool and access the cluster, using the following command:

   aws eks update-kubeconfig --region <region_name> --name <cluster_name>
   

6. Verify the access to the cluster, using the following command:

   kubectl get nodes