Proxy configuration

Overview

Where a site enforces all outbound traffic through a proxy, configure the collector to use it explicitly. Because the collector runs as a system service (not an interactive user session), it does not automatically inherit a logged-in user's browser proxy settings.

Windows

AssurIQCollectorSetup.exe /quiet ENROLLMENT_TOKEN=<token> ASSURIQ_URL=<control-plane-url> PROXY_URL=http://proxy.internal:3128

To change the proxy after install, update the collector configuration file under the service's program data directory and restart the AssurIQCollector service.

Linux

sudo systemctl edit assuriq-collector

[Service]
Environment="HTTPS_PROXY=http://proxy.internal:3128"
Environment="NO_PROXY=localhost,127.0.0.1"

sudo systemctl daemon-reload
sudo systemctl restart assuriq-collector

Docker

docker run -d \
  --name assuriq-collector \
  --network host \
  --restart unless-stopped \
  -e HTTPS_PROXY="http://proxy.internal:3128" \
  -e ASSURIQ_ENROLLMENT_TOKEN="<token>" \
  -e ASSURIQ_URL="<control-plane-url>" \
  assuriq/collector:latest

Authenticated proxies

If the proxy requires authentication, embed credentials in the proxy URL (http://user:pass@proxy.internal:3128) or use a service-account credential stored by the proxy vendor's client agent. Rotate proxy credentials the same way as any other service account.

PAC files and TLS inspection

• Firewall and egress requirements
  The collector is outbound-only. What to allow, on which ports, and why no inbound rules are ever needed.

Troubleshooting

If a collector goes offline immediately after a proxy configuration change, verify the new proxy host, port and credentials, then re-test with a manual connectivity check from the host before assuming the collector itself is at fault.

• AIQ-COL-001Collector offline
  The collector has not sent a heartbeat within the expected interval. Discovery, scans and evidence collection for its sites are paused.