Quick Start: Administrators

Learn more at Stellar Cyber Academy.

The following link takes you to a course on the Stellar Cyber Academy technical training portal where you can learn more about this topic by watching the suggested lessons.

(2024) ADMIN - Admin Essentials for Tenants Users and System (03h:46m)

L00A-PRES: Introduction and Agenda (05m:24s)

Explore essential administrative tasks in the Stellar Cyber Platform, including tenant configuration, role-based access control, two-factor authentication, and certificate management for secure access. Learn how to configure custom-branded logos, mail server settings for alert notifications, and set up the System Action Center for real-time monitoring and notifications.

L01A-PRES: Multi-Tenant Concepts and Config (19m:22s)

Understand multi-tenant architecture within the Stellar Cyber Platform, including data segregation, machine learning customization per tenant, and operational views for managed security service providers (MSSPs). Learn how to create and configure tenants for security monitoring and data processing across multiple organizations or business units.

L01B-DEMO: Multi-Tenant Concepts and Config (16m:00s)

Watch a demonstration on creating tenants and configuring access levels. Set up a tenant admin user with two-factor authentication and explore how tenant-specific data is managed and secured within the Stellar Cyber Platform.

L02A-PRES: User Management with Role-Based Access Control (12m:05s)

Discover how to manage user privileges using role-based access control (RBAC). Configure privilege profiles like Super Admin, Platform Admin, and Security Admin to control access levels within the Stellar Cyber Platform and meet organizational security needs.

L02B-DEMO: User Management with Role-Based Access Control (15m:56s)

Follow a demonstration on configuring RBAC profiles and assigning privilege levels to users. Learn how to apply scopes and roles to provide secure access to tenants while ensuring compliance with organizational policies.

L03A-PRES: User Management with Multi-Tenant Architecture (26m:34s)

Learn how to assign users to specific tenants or tenant groups, configure API access, and set up two-factor authentication for secure access. Gain insights into viewing user activity logs and monitoring active session connections to ensure compliance and security within the Stellar Cyber Platform.

The first time you access a link on the portal during a session, you must log in to access content.

Each user's function working with Stellar Cyber can vary. In many deployments, the administrator will have a different perspective than an analyst. During initial setup and on an ongoing basis, you will use the Stellar Cyber user interface to integrate data sources, configure dashboards and automations, and manage the server and users. Those configuration settings are spread throughout the Stellar Cyber interface.

After reviewing the main Getting Started topic, you may find this section helpful to familiarize yourself with the location of configuration pages you may need.

• When you install your Stellar Cyber components, you may follow a sequence similar to below. Use this as a guide while you review the links for configuration and administration.

  1. Install and license your Data Processor.

  2. Configure Stellar Cyber Server.

     • Web server, certificates, SSO / 2FA

     • Mail server / SMTP 

     • Users, Tenants, Tenant Groups

     • Backup and storage

  3. Add / customize Data Analyzer configurations.

  4. Install sensors and parsers.

  5. Add connectors and parsers with their associated profiles.

  6. Configure Automated Threat Hunting playbooks.

• This list highlights settings for the server itself, mail, users, tenants, and other general configuration options.

  • The System | Administration section addresses the server-level settings such as users, tenants, licensing, upgrades, and so on.

  • As part of your installation, you use the System | ORGANIZATION MANAGEMENT | Settings page to configure the web server parameters, including the SSO / authentication requirements for how your users will access the server.

  • The SMTP parameters for the system, used for system issues and email alerts, is configured from the System | ORGANIZATION MANAGEMENT | Mail Server menu.

  • Ideally, you will configure external storage, cold storage, and backup plans during your installation process. The System | DATA MANAGEMENT | Data Management page is used to configure all your storage options and schedule backups and perform recovery.

  • The steps to install your data processor include configuration of a Data Analyzer and Data Lake. Familiarize yourself with these screens, available in the System | DATA MANAGEMENT | Data Management section. The Data Analyzer must be set up prior to configuring sensors and collectors.

  • In the System | ORGANIZATION MANAGEMENT section, create and manage users from Users and Role-based Access Control. Even if you have configured SSO, you will still need to set certain user access parameters.

  • For partner and MSSP deployments, configure Tenants and Tenant Groups, depending on your organizational needs.

  • View license consumption from the System | ORGANIZATION MANAGEMENT | Licensing screen or Reporting | Reports | License Usage tab.

• The following list highlights configurations related to data integration and response, which you begin to use after the fundamental aspects of the server are configured.

  • In the System | DATA MANAGEMENT section, you'll find configurations for storage, analytics and other resources for the data processor itself.

  • Take a look at the Ports list so you are familiar with the ingoing and outgoing ports that are required for your deployment plan.

  • External sources for ingestion and response (Connectors and Sensors and Custom Parsers) are added and configured from the System | DATA SOURCE MANAGEMENT and System | INTEGRATIONS sections.

  • Windows and Linux server sensors are deployed from the System | DATA SOURCE MANAGEMENT section. 

  • Each sensor must be associated with a sensor profile, which in turn must be associated with a specific receiver. Receivers are also configured from the Collection section. Use the receiver configuration to specify which data analyzer the receiver is associated with, the port, and nature of the incoming data (json or packet), then add the receiver to a sensor profile.

  • To manage the volume of data ingested from sensors, you can also set up traffic and log filters; these are accessed from the Collection section.

  • Dashboards are configured from the Dashboards menu. You can use these dashboards to configure and schedule reports Reporting functions are accessible from the Reporting menu.

  • Either you or an analyst can configure custom, automated threat hunting actions from the Automation menu. These automated playbooks based on specific data and conditions are configured to perform a response action. The System section includes options to configure recipients on the server, scripts, and other settings to support playbooks and other general functions.