Google Cloud: CLI (gcloud)¶

Deploy the RTA with a single gcloud compute instances create command. This is the fastest path: no Console navigation, no org-picker workaround, and no image copy required.

Before you start

Review the Google Cloud overview. You'll need the image name and your SSH public key from your engagement lead, the Google Cloud SDK installed and authenticated (gcloud auth login), and a GCP project with the Compute Engine API enabled.

Quick deploy¶

One command creates the instance. Fill in the placeholders (explained in the table below), then read the activation code off the serial console.

gcloud compute instances create sophos-rta \
  --project=YOUR_PROJECT_ID \
  --zone=ZONE \
  --machine-type=e2-standard-4 \
  --image=IMAGE_NAME \
  --image-project=IMAGE_PROJECT \
  --boot-disk-size=40GB \
  --boot-disk-type=pd-balanced \
  --no-address \
  --enable-display-device \
  --metadata="ssh-keys=<username>:$(cat ~/.ssh/your_key.pub)"

Replace the following placeholders:

Placeholder	Value
`YOUR_PROJECT_ID`	Your GCP project ID (e.g. `acme-pentest-2025`)
`ZONE`	A zone in your preferred region (e.g. `europe-west1-b`)
`IMAGE_NAME`	The image name provided by your engagement lead
`IMAGE_PROJECT`	The Sophos-owned image project to launch from, provided by your engagement lead
`<username>`	Any Linux username you choose; GCP creates it from the key metadata, and you only use it for break-glass SSH

--enable-display-device is required

Without this flag, the RTA console is inaccessible. There is no way to add the display device to a running instance; it must be set at create time.

Machine type

e2-standard-4 (4 vCPU / 16 GB) is recommended. Use e2-standard-2 (2 vCPU / 8 GB) only if resources are constrained; it meets the minimum spec but will be slower during engagements.

No external IP address

--no-address creates the instance without an external IP. The appliance only needs outbound internet access through your VPC's Cloud NAT or an existing internet gateway; no inbound ports need to be open.

Supply your SSH key¶

The example above injects the key via instance metadata (ssh-keys). If your project already has a suitable project-level SSH key, you can omit the --metadata flag entirely.

Alternatively, set a project-level default that applies to all new instances:

gcloud compute project-info add-metadata \
  --project=YOUR_PROJECT_ID \
  --metadata="ssh-keys=<username>:$(cat ~/.ssh/your_key.pub)"

Verify¶

# Get the internal IP of the new instance
gcloud compute instances describe sophos-rta \
  --project=YOUR_PROJECT_ID \
  --zone=ZONE \
  --format='get(networkInterfaces[0].networkIP)'

# SSH from inside the VPC (or via your VPN) as the username from your key metadata
ssh <username>@<INTERNAL_IP>

Send us the activation code¶

The image is generic, so on first boot the appliance comes up in activation mode. You normally do not log in at all. Read the activation code from the serial console:

gcloud compute instances get-serial-port-output sophos-rta \
  --project=YOUR_PROJECT_ID \
  --zone=ZONE

The console shows the Appliance Registration screen: a one-time activation code (for example 4 5 D C V Y) under the prompt "Provide this code to your Sophos staging team." You do not log in to the appliance to read it.

Send that activation code to your Sophos engagement lead so they can activate the appliance on the Sophos side. Once activated, the console switches from the registration screen to the appliance's live status dashboard, and no further action is needed on your end.

Registration needs outbound 443 to get.remotetesting.secureworks.com

Registration and activation use outbound TCP/443 (HTTPS) to get.remotetesting.secureworks.com, in addition to the OpenVPN tunnel to connect.remotetesting.secureworks.com covered under Network access below. Its IP addresses are not guaranteed to stay constant, so allowlist get.* by FQDN (not by IP). If that egress is blocked, the console shows a registration error ("ensure outbound HTTPS to get.remotetesting.secureworks.com") instead of an activation code.

First-boot timing

cloud-init completes within 2 minutes on a healthy instance. If ssh refuses connections for the first minute, that is normal; the login account is still being provisioned. Retry after 90 seconds.

Network access¶

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination


Destination	`connect.remotetesting.secureworks.com`
IP addresses	`3.33.194.251` and `15.197.255.2` (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting¶

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.