Google Cloud: GUI (Cloud Console)

Deploy the RTA entirely from the GCP Cloud Console. You'll navigate to Compute Engine, create a new VM instance, and select our shared image as the boot disk, with no CLI tools required.

Before you start

Review the Google Cloud overview. You'll need the image name and your SSH public key from your engagement lead, and a GCP project with the Compute Engine API enabled.

Quick deploy

Experienced operators can work straight from this outline; the detailed walkthrough with screenshots follows below.

1. Compute Engine → VM instances → Create instance; name it, pick a region/zone, set Machine type to e2-standard-4.
2. Boot disk → Change → Custom images, open Source project, set the org filter to "No organization" or "All", pick the project your engagement lead provided, then select the image (40 GB boot disk).
3. Observability → Enable display device (required, and cannot be added later, without it the RTA console is inaccessible).
4. Networking: your VPC/subnet with outbound internet, External IPv4 = None.
5. Security: add your SSH public key.
6. Create, then read the activation code from Serial port 1 (console) and send it to your engagement lead.

1. Open VM Instances

1. Go to Compute Engine → VM instances in your GCP project.
2. Click Create instance.

2. Configure name, region, and machine type

1. Enter a name for the instance (e.g. sophos-rta).
2. Choose a Region and Zone close to your engagement targets.
3. Under Machine configuration, set Machine type to e2-standard-4 (4 vCPU / 16 GB). Use e2-standard-2 only if resources are constrained.

3. Select the shared boot image

1. Under Boot disk, click Change.
2. Select the Custom images tab.

3. Open the Source project dropdown.

   Switch the organization filter first

   The picker defaults to your organization. The image project is Sophos-owned and outside your org, so it will not appear until you change the filter. At the top of the dropdown, set the organization selector to "No organization" or "All", then search for the project name your engagement lead provided and select it.

4. In the Image list, select the image name provided by your engagement lead (e.g. <IMAGE_NAME>).

5. Confirm Boot disk size is 40 GB.
6. Click Select.

4. Enable the display device

1. In the left-hand section list, click Observability (or scroll down to the Observability section).
2. Check Enable display device.

Do not skip this step

The display device is disabled by default. Without it, the RTA console is inaccessible. You cannot enable it after the instance is created; you must set it at create time.

5. Configure networking

1. Click Networking in the section list.
2. Under Network interfaces, select an existing VPC network and subnetwork that has outbound internet access.
3. Set External IPv4 address to None; the appliance only needs outbound access and does not require a public IP.

6. Add your SSH key

1. Click Security in the section list (or expand Advanced options → Security).
2. Under Manage access, click Add item under SSH keys.
3. Paste your public SSH key. GCP maps the key to the username embedded in it; you'd SSH in as that user only if break-glass access is ever needed.

Project-level SSH keys

If your GCP project already has a suitable project-level SSH key, you don't need to add an instance-level key.

7. Create the instance

Click Create. GCP will start the instance within a minute or two.

Verify

The instance has no external IP. In VM instances, confirm the new instance is running and note its Internal IP. If you need shell access, SSH from a host inside the same VPC (or via your VPN):

ssh <username>@<INTERNAL_IP>

Send us the activation code

The image is generic, so on first boot the appliance comes up in activation mode. Read the code from the serial console:

1. Open the instance and go to Observability → Serial port 1 (console) (or Logs → Serial port output).

The console shows the Appliance Registration screen: a one-time activation code (for example 4 5 D C V Y) under the prompt "Provide this code to your Sophos staging team." You do not log in to the appliance to read it.

Send that activation code to your Sophos engagement lead so they can activate the appliance on the Sophos side. Once activated, the console switches from the registration screen to the appliance's live status dashboard, and no further action is needed on your end.

Registration needs outbound 443 to get.remotetesting.secureworks.com

Registration and activation use outbound TCP/443 (HTTPS) to get.remotetesting.secureworks.com, in addition to the OpenVPN tunnel to connect.remotetesting.secureworks.com covered under Network access below. Its IP addresses are not guaranteed to stay constant, so allowlist get.* by FQDN (not by IP). If that egress is blocked, the console shows a registration error ("ensure outbound HTTPS to get.remotetesting.secureworks.com") instead of an activation code.

Network access

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination

Destination	connect.remotetesting.secureworks.com
IP addresses	3.33.194.251 and 15.197.255.2 (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.