Installing a Modular Sensor in Azure

This topic describes how to install a Modular Sensor in Azure.

About Modular Sensors

Sensors provide the data gathering foundation for Stellar Cyber's OpenXDR platform, gathering the right data with context. Modular sensors are purpose-built Stellar Cyber sensors that include both the host and the Stellar Cyber monitoring software. They are provided as both physical devices (Photon sensors) and virtual machine images for different target environments.

Previous releases provided a variety of different types of device sensors, including Network, Security, and Modular. Going forward, the only type of device sensor is Modular. You can use the Modular Sensor Profile to enable whatever sensor features you like, creating the same functionality provided by the different sensor types in previous releases.

A modular sensor lets you easily add the features you like to your sensor. This helps simplify your deployment and lets you manage the VM requirements for the sensors based on the modular features they use.

Modular Sensors always include log ingestion. From there, you can enable different features as part of your modular sensor profile:

  • Enable the Network Traffic feature to monitor the virtual environment, the physical environment if connected to the span port of a physical switch, or the LAN segment via a mirror port on a switch. The sensor monitors network and server response times and can identify applications.

    The sensor converts that information to metadata and forwards it to the DP as Interflow. The DP can then provide security, DDoS, and breach attempt detections.

  • Enable the Sandbox and IDS features to improve your security posture:

    • Sandbox lets you detect malware in files and network traffic through Stellar Cyber's integrated cloud service and also provides anti-virus services.
    • IDS lets you detect intrusion attempts using both files and network traffic.

Keep in mind that VM resource requirements increase as you add more features to the Modular Sensor Profile. Refer to Modular Sensor Specifications for details on the resources required to run different combinations of features in a Modular Sensor Profile, as well as how to use the show module and show module request CLI commands to compare provisioned resources against those required to run specific feature combinations. Stellar Cyber only enables a Modular Sensor Profile on a sensor if the host VM's resources can support it.

Installation Summary

You can install a Modular Sensor in Azure. To install you must:

  1. Prepare.
  2. Authorize the Stellar Cyber software image.
  3. Connect to the DP.
  4. Authorize the sensor.

Use our example as a guideline, as you might be using a different software version.

Stellar Cyber does not support the installation of third-party software on its virtual or physical device sensors.

Preparing

Click to see the minimum system requirements for installing a modular sensor. Then, select an Azure instance type that meets the stated requirements for your expected sensor workload.

The Azure instance types in the script provided below use the instance types listed below:

Keep in mind that these are example instance types that meet the requirements stated in Virtual Appliance Sizing Specifications. You can select other instance types with the necessary vCPUs and RAM to perform your expected workload, as stated in the system requirements.

  • Network Traffic – Standard_B12ms
  • Sandbox and IDS Enabled – Standard_F16s_v2

To prepare for the installation:

  1. Open firewall ports for log ingestion.
  2. Open firewall ports for Network Traffic, Sandbox, and IDS features, as necessary.

  3. Contact Stellar Cyber support (support@stellarcyber.ai) to have the sensor images deployed in your region. You will need to provide the Azure region for the sensors your are installing.

    Do this at least a day before installing, so we have enough time to deploy the images to your region.

Current Azure Sensor Versions

The current sensor versions for Azure deployments are as follows:

  • Modular Sensor – 5.2.0

Contact Stellar Cyber support (support@stellarcyber.ai) if you need a different version.

Authorizing the Stellar Cyber Software Images

You must authorize the Stellar Cyber software images so that they are available in the Azure portal:

  1. Log in to your Azure portal at https://portal.azure.com/.

  2. Click the hamburger menu at the upper left and select the entry for Microsoft Entra ID.

    Your Microsoft Entra Overview page appears.

  3. Scroll down and click Properties.

    The Properties page appears.

  4. Copy the value shown for Tenant ID. You need this for the next step and also when creating the VM, so keep it handy.

  5. Put your Tenant ID in the following URL and paste it in your browser:

    https://login.microsoftonline.com/<tenant id>/oauth2/authorize?client_id=58238038-43b4-4446-8260-0fa97ace1085&response_type=code&redirect_uri=https%3A%2F%2Fwww.microsoft.com%2F

    The Permissions requested message appears.

  6. Click Consent on behalf of your organization.

  7. Click Accept.

  8. Click Enterprise Applications.

    The Enterprise applications | All applications page appears.

  9. Search for Stellar. The Stellar Cyber applications that you authorized appear.

    If you don't see any Stellar Cyber applications, contact Stellar Cyber support.

  10. You can either create a new Resource Group for the deployment or deploy into an existing group. Use this step to create a new Resource Group. Otherwise, you can skip to the next step.

    1. Click Resource Groups.

      The Resource groups page appears.

    2. Click Add. The Create a resource group page appears.

    3. Choose your Subscription.

    4. Enter the name of your group in the Resource group field.

    5. Choose the Region where you want to deploy the resource. Here's how our resource group looks so far:

    6. Click Review create.

    7. Click Create. The resource group is created and the Resource groups page appears.

  11. Click the name of the resource group where you want to deploy the sensor. This is either the resource group you just created or an existing resource group.

    The group details appear.

  12. Click Access control (IAM).

    The Access control (IAM) page appears.

  13. Click Add role assignments to display the Add role assignment controls.

  14. Click on Privileged administrator roles and choose the Contributor option, as illustrated below:

  15. Leave the default selection of User, group, or service principal in the Assign access to drop-down.

  16. Enter Stellar in the Select field. The available Stellar Cyber software packages appear.

  17. Choose Stellar Cyber Software Packages.

  18. Click Save. The Resource groups page appears again.

  19. Click Home. The Azure services page appears.

  20. Click Subscriptions. The Subscriptions page appears.

  21. Choose your subscription. The subscription details appear.

  22. Click Resource providers.

    The Resource providers page appears.

  23. Select Microsoft.Network.

  24. Click Register.

  25. Select Microsoft.Compute.

  26. Click Register.

  27. Click Cloud Shell.

  28. Select the PowerShell option in the dialog box that appears:

  29. Create an inbound security group for the sensor using the commands below, replacing <resource-group> with the name of your resource group and <NSG NAME> with the name of your network security group:

    1. Create the Network Security Group:

      az network nsg create -g <resource-group> -n <NSG NAME>

    2. Add an inbound rule for SSH (TCP 22), replacing <Trusted CIDR> with the trusted CIDR range that can SSH into the sensor (for example, 8.8.8.8/32):

      az network nsg rule create -g <resource-group> --nsg-name <NSG NAME> -n AllowSSH --direction Inbound --protocol Tcp --source-address-prefixes '<Trusted CIDR>' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 22 --access Allow --priority 500

    3. Add an inbound rule for UDP port 8472, replacing <Trusted CIDR> with the trusted CIDR range where the DP is deployed:

      You can skip this step if you're not using VxLAN forwarding.

      az network nsg rule create -g <resource-group> --nsg-name <NSG NAME> -n AllowUDP4872 --direction Inbound --protocol Udp --source-address-prefixes '<Trusted CIDR>' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 8472 --access Allow --priority 600

  30. You use a customized version of the script shown in Azure Installation Script to install a Modular Sensor in Azure. Before you use the script, you must customize it with variable definitions that match your Azure subscription and networking environment.

    1. Start by pasting the contents of the Azure Installation Script into a text editor.

    2. Customize the script with variable definitions that match your Azure subscription and networking environment for the items listed in Variables for the Azure Installation Script .

    3. Copy and paste the customized script into the Azure Cloud Shell to create the Modular Sensor.

    Refer to this article for more information on the New-AzVM cmdlet used by the script to install a Modular Sensor VM.

Azure Installation Script

Paste the contents of this script into a text editor and supply your own values for the variables shown in angle brackets ("<variable>"). The necessary variables are listed and described in Variables for the Azure Installation Script.

Copy 
Clear-AzContext -Force
#Supply your own values for the variables below:
$resourceGroup = "<resource group name>"
$location = "<Azure region>"
$vmNamePrefix = "StellarVM-Sensor"
$vnetName = "<virtual network name>"
$subnetName = "<subnet name>"
$nsg_name = "<network security group name>"
$tenant_customer = "<Azure tenant_id>"
$subscription_customer = "<Azure subscription_id>"
#change stellarInstanceType to install Modular Sensor or DP
$stellarInstanceType = "Stellar-ModularSensor"
#$stellarInstanceType = "Stellar-DataProcessor"
#install the specified version below
$imageVersion = "5.4.0"  
############################################################################
#Stellar Cyber parameters, do not change
$applicationId = '58238038-43b4-4446-8260-0fa97ace1085'
$secret = 'mdb8Q~2-lm0jpEF_lm24K52udUCKZDrD05e_wdmk' | ConvertTo-SecureString -AsPlainText -Force
$tenant_stellar = "2f580e30-1cc1-4c08-9e80-704999508e1a"
############################################################################

if ($stellarInstanceType -eq "Stellar-DataProcessor") {
    $osDiskSize = 512
    $osVMSize = "Standard_E16s_v3"
}else{
    $osDiskSize = 128
    $osVMSize = "Standard_B12ms"
}
$cred = New-Object -TypeName PSCredential -ArgumentList $applicationId, $secret
Connect-AzAccount -ServicePrincipal -Credential $cred -Tenant $tenant_stellar
Connect-AzAccount -ServicePrincipal -Credential $cred -Tenant $tenant_customer
az account set --subscription $subscription_customer

# Get the specific subnet object
$vnet = Get-AzVirtualNetwork -ResourceGroupName $resourceGroup -Name $vnetName
$subnet = Get-AzVirtualNetworkSubnetConfig -Name $subnetName -VirtualNetwork $vnet
# Get subnet ID
$subnetId = $subnet.Id

$randomString = [guid]::NewGuid().ToString("N").Substring(0, 8)
$vmName = "StellarVM-Sensor-$randomString"

$image = "/subscriptions/0e28f851-f477-4f2d-94bc-35c00d3d5fd8/resourceGroups/Stellar/providers/Microsoft.Compute/galleries/StellarCyberSoftwares/images/$stellarInstanceType/versions/$imageVersion"

#Networking pieces
$pip = New-AzPublicIpAddress -ResourceGroupName $resourceGroup -Location $location -Name "mypublicdns$(Get-Random)" -AllocationMethod Static -IdleTimeoutInMinutes 4
$nsg = Get-AzNetworkSecurityGroup -Name $nsg_name -ResourceGroupName $resourceGroup
$nic_name = "Stellar-nic-$randomString" 
$nic = New-AzNetworkInterface -Name $nic_name -ResourceGroupName $resourceGroup -Location $location -SubnetId $subnetId -PublicIpAddressId $pip.Id -NetworkSecurityGroupId $nsg.Id

#Create a virtual machine configuration using the $image variable to specify the image
#$vmConfig = New-AzVMConfig -VMName $vmName -VMSize $osVMSize | Set-AzVMOperatingSystem -Linux -ComputerName $vmName -Credential $cred | Set-AzVMSourceImage -Id $image | Add-AzVMNetworkInterface -Id $nic.Id
$vmConfig = New-AzVMConfig -VMName $vmName -VMSize $osVMSize |
    Set-AzVMOperatingSystem -Linux -ComputerName $vmName -Credential $cred |
    Set-AzVMSourceImage -Id $image |
    Set-AzVMOSDisk -CreateOption FromImage `
                    -DiskSizeInGB $osDiskSize `
                    -Caching ReadWrite `
                    -Name "$vmName-OSDisk" `
                    -StorageAccountType "StandardSSD_LRS" |
    Add-AzVMNetworkInterface -Id $nic.Id

#Create a virtual machine
New-AzVM -ResourceGroupName $resourceGroup -Location $location -VM $vmConfig

Variables for the Azure Installation Script

You will need to supply values for the variables in the table below in the Azure Installation Script before you use it in the Azure Cloud Shell. Keep in mind the following rules for variables:

  • The specified resourceGroup must already exist.

  • The values you supply for the vnetName, subnetName, and nsg_name arguments must exist in the specified resource group.

Installation Script Variable

Definition
$resourceGroup The name of the Azure Resource Group where the Modular Sensor will be installed.
$location The Azure Region where the Modular Sensor will be installed.

$vmNamePrefix = "StellarVM-Sensor"

Optional. The Modular Sensor VM is named with this prefix followed by a random string (by default, StellarVM-Sensor-<random-string>). You can rename the VM within Azure after it is deployed. However, if you would prefer a different default prefix, you can change it here.
$vnetName The name of the virtual network for the Modular Sensor. You can use the az network vnet list command to see available virtual networks.
$subnetName The name of the subnet for the Modular Sensor. You can use the az network vnet subnet list command to see the subnets in a virtual network.
$nsg_name

The name of the Network Security Group for the Modular Sensor. You can use the az network nsg list command to see available Network Security Groups.
$tenant_customer The Azure tenant ID for the deployment. You can use the az account list --output table command to see the subscription and tenant IDs available for your account.
$subscription_customer The Azure subscription for the deployment. You can use the az account list --output table command to see the subscription and tenant IDs available for your account.

Connecting the Sensor to the Stellar Cyber Platform

To connect the sensor to the Stellar Cyber Platform:

  1. Log in to your new sensor. The default username/password is aella/changeme. You are immediately prompted to change the password.

  2. Change the password.

    After you change the password, your session closes automatically. When you log back in with your new credentials, the prompt changes to DataSensor>.

  3. Set the host name. The host name is displayed in Stellar Cyber and should be unique for each sensor:

    set hostname <new hostname>

  4. If necessary, set the proxy HTTP server:

    set proxy http://<proxy IP address:port>

    Note: The CLI prevents you from entering non-printable characters as part of the username or password for the proxy, as well as the proxy itself.

  5. Optionally assign the tenant (if you skip this, the sensor is assigned to Root Tenant):

    set tenant_id <Tenant ID from Stellar Cyber>

  6. Use the set cm command to specify the IP address to reach the management interface of the Stellar Cyber Platform. For a cluster, this is the IP address of the DL-master's management interface. For a single DP deployment, this is simply the Stellar Cyber Platform's management IP address. You can specify either an IP address or a hostname. For example:

    set cm 192.168.44.10

    or:

    set cm example.company.com

    If you specify a hostname rather than an IP address, the system attempts to verify the hostname with the DNS server. If the DNS server is not reachable, the system reports the error and lets you either proceed with the configured hostname or quit. This way, you can specify a hostname for the set cm destination in an offline environment without access to a DNS server.

  7. Verify with the show cm command. You should see the IP address of the Stellar Cyber Platform listed as the CM Controller and the Status should be Established.

  8. Use the show time command to view the time zone.

    During installation, the timezone for sensors are automatically set to UTC+0. Since the logs for some security products may only include the local time without a timezone, Stellar Cyber recommends that you set the sensor timezone to the same timezone as your security product.

  9. Log out with the quit command.

The sensor automatically contacts the DP to register itself.

Authorizing the Sensor

You must authorize the sensor when it appears in the network.

You can authorize multiple sensors at a time. So if you're installing multiple sensors, install them all, then authorize them all at once.

Enabling SSSE3 for the Sensor VM

The sensor VM must have SSSE3 enabled for its processors in order for the Modular Sensor to operate correctly. In most cases, SSSE3 will already be enabled. However, if you encounter issues with packet collection or Interflow data generation, you can use the instructions below to ensure that SSSE3 is enabled.

(missing or bad snippet)