###################################
Atomic Inspector
###################################

**Atomic Inspector** is an **analyst console** for security operations on the Atomic OSSEC **hub**. It uses **OpenSearch** as its search and indexing backend so analysts can explore **alerts and related data** that the hub has already collected and processed. **Alerts from the hub** are passed into Inspector for search and investigation workflows.

Inspector is **not** a replacement for the main Atomic OSSEC web console for day-to-day administration. It is aimed at **investigation workflows**: searching, correlating, and reviewing hub-originated alert traffic in a dedicated interface.

Requirements
============

- **Atomic OSSEC hub** — Install Inspector **on the hub server** after the hub is installed and working. 
- **System Resources** — Because Inspector runs **OpenSearch** and **OpenSearch Dashboards** in containers, the host server requires additional resources (CPU and Memory) above the base hub installation:

  - **Cores**: 8 vCPUs Minimum, 16 vCPUs Recommended.
  - **Memory**: 16 GB RAM Minimum, 32 GB Recommended.
  - **Storage**: High-speed storage (SSD or NVMe) is strongly recommended for OpenSearch indexing performance. Retention requirements will significantly impact disk space needs.

Command Line Network Installer
==============================

For environments with direct internet access, the network installation method is recommended.

**Step 1: Log in and become root on the system**

.. code-block:: console

   sudo su -i

**Step 2: (Optional) Configure outbound proxy settings before install**

Required when the host reaches ``updates.atomicorp.com`` (TCP/443) only through a
corporate HTTP/HTTPS proxy. Set these in the **same root shell** before running
``curl``/``wget`` so the download and the installer inherit them.

.. code-block:: console

   export http_proxy=http://<PROXY_HOST>:<PORT>
   export https_proxy=http://<PROXY_HOST>:<PORT>
   # Optional: authenticated proxy (user:pass in the URL)
   # export http_proxy=http://<USER>:<PASS>@<PROXY_HOST>:<PORT>
   # export https_proxy=http://<USER>:<PASS>@<PROXY_HOST>:<PORT>
   # Optional: bypass proxy for local/LAN destinations
   # export no_proxy=localhost,127.0.0.1,.local

Alternatively, pass installer flags:

.. code-block:: console

   --https-proxy=<URL>
   --https-proxy-username=<PROXY_USER>
   --https-proxy-password=<PROXY_PASS>

.. note::
   Session ``export`` values apply only to the current shell. If package or container
   image pulls fail after the installer starts, set a persistent package-manager proxy
   (for example ``proxy=`` under ``[main]`` in ``/etc/dnf/dnf.conf``) and re-run.

.. note::
   Pre-install outbound proxy is for reaching Atomicorp update servers during network
   install. Post-install product ``HTTP_PROXY*`` settings (see
   :doc:`/AEO/configuringAO/index`) are separate and apply to ongoing hub updates.

**Step 3: Run the Atomic Inspector installer**

.. code-block:: console

   curl https://updates.atomicorp.com/installers/awp-db | sudo bash

Follow any prompts from the script. When it finishes, use the analyst console URL and credentials the installer reports (or your organization’s standard access method).

Offline ISO Installer
=====================

.. note::

   This installation option is only available with a specialty license. Please contact sales@atomicorp.com for more information.

For environments without internet access. Pre-install outbound proxy configuration does
**not** apply to the offline ISO path (no connection to ``updates.atomicorp.com`` during install).

**Step 1: Download the Atomic Inspector ISO**

Download the appropriate ISO for your platform from:
https://updates.atomicorp.com/channels/isotope/

**Step 2: Mount the ISO on the server**

Copy the ISO to the target Atomic OSSEC hub and mount it:

.. code-block:: console

   sudo mount -o loop awp-inspector.iso /mnt

**Step 3: Run the installation utility**

Execute the offline installation script from the mount point, passing the mount point path as an argument:

.. code-block:: console

   sudo /mnt/awp-db-offline.sh /mnt

The installer will configure a local repository, load the necessary container images (OpenSearch, Dashboards, and Inspector services), and prompt you to set the initial admin password.

.. note::

   Both network installers use **curl** to fetch scripts from ``updates.atomicorp.com``. The **hub** installer runs **awp-hub** (see :doc:`/AEO/server/installation/index`). **Inspector** runs **awp-db** with ``| sudo bash`` on an **existing** hub.
