Quick Start: Administrators

Each user's function working with Stellar Cyber can vary. In many deployments, the administrator will have a different perspective than an analyst. During initial setup and on an ongoing basis, you will use the Stellar Cyber user interface to integrate data sources, configure dashboards and automations, and manage the server and users. Those configuration settings are spread throughout the Stellar Cyber interface.

After reviewing the main Getting Started topic, you may find this section helpful to familiarize yourself with the location of configuration pages you may need.

  • This list highlights settings for the server itself.

    • The System | Administration menu addresses the server-level settings such as users, tenants, licensing, and so on.

    • As part of your installation, you use the System | Administration | Settings page to configure the SSO / authentication requirements for how your users will access the server.

    • Create and manage users from the System | Administration menu's User Management and Role-based Access Control (RBAC) menu options. Even if you have configured SSO, you will still need to set certain user access parameters.

    • For partner / MSSP deployments, configure Tenants and Tenant Groups, depending on your organizational needs.

  • The following list highlights configurations related to data integration and response, which you begin to use after the fundamental aspects of the server are configured.

    • Take a look at the Ports list so you are familiar with which ingoing and outgoing ports are required for your deployment plan.

    • External sources for ingestion and response (Connectors and Sensors ) are added and configured from the System | Collection and System | Integration menus.

    • Each sensor must be associated with a sensor profile, which in turn must be associated with a specific receiver. Receivers are also configured from the Collection menu.

    • To manage the volume of data ingested from sensors, you can also set up traffic and log filters; these are accessed from the Collection menu.

    • Dashboards are configured from the Visualize menu. You can use these dashboards to configure and schedule reports Reporting functions are accessible from the Respond menu.

    • Either you or an analyst can configure custom, automated threat hunting actions from the Respond | Automation menu. These automated playbooks based on specific data and conditions are configured to perform a response action. The System | Configuration menu includes options to configure recipients on the server, scripts, and other settings to support playbooks and other general functions.