Creating a Clone Template for Linux Server Sensor VMs

This topic describes how to create a clone template from a virtual machine with a Linux Server Sensor installed so that it can be duplicated and reused elsewhere in your virtual environment. The topic describes how to do this in AWS, but the same procedure can be used in other virtual environments, all of which provide tools to duplicate virtual machines.

Refer to the following sections for details:

• Understanding Cloning

• Creating and Using a Clone Template

Clone Templates Are for Linux Server Sensors Only!

The clone template feature can only be used with Linux Server Sensors in on-premises deployments. You cannot use clone templates in SaaS deployments (deployments with an "s" in their version number; for example, 6.0.0s).

Understanding Cloning

The Challenge

Sensors are uniquely identified by an Engine ID. No two Sensors can share the same Engine ID. If you use your cloud management interface to clone a VM with a Sensor installed, you end up with two Sensors with the same Engine ID.

The Solution

You can get around this issue by resetting Engine IDs on individual VMs as you clone them. However, this can be tedious when you are creating multiple clones from a single VM.

As an improved solution, Stellar Cyber provides a clone template feature that temporarily removes the Engine ID from the Sensor so that it can be shut down, cloned multiple times, and then restarted. Both the source Sensor and each of the clones receive new, unique Engine IDs when they are restarted.

Sensor Settings for Cloned Sensors Preserved

Both the source Sensor and each of the clones retain the settings from the source Sensor used to create the clone template, including the managing Stellar Cyber platform and tenant settings (that is, the set cm, set aggregator, and set tenant_id settings).

Clones automatically add themselves to the same managing DP as the source Sensor and must be authorized there. The source Sensor does not need to be reauthorized even though it will have a new Engine ID after it is restarted.

Creating and Using a Clone Template

The following procedure describes how use the clone template feature:

1. Install and configure the sensor you want to use as the source for the clone template. Make sure the set cm, set aggregator, and, if desired, set tenant_id settings are all configured.

2. Open an SSH connection to the Sensor VM and start the sensor CLI with the following command:

   $ aella_cli

   Caution: The next step shuts down the Stellar Cyber services for the Sensor, temporarily taking it offline from the DP. Make sure you are ready to do this.

3. Create a clone template from the VM with the following command:

   DataSensor> create sensor_clone_template

   You can include a tenant_id as part of this command if the source sensor either doesn't have one configured or you want to use a different tenant_id for the clones created using this template. The syntax is as follows:  create sensor_clone_template [tenant_id]. The tenant_id specified here is applied to all clones created using this template.

4. Confirm your decision to create the template at the sensor's prompt.

   Once you confirm your decision, the following takes place:

   • The Stellar Cyber services for the Sensor are shut down. The host VM itself is not shut down.

   • The Engine ID is removed.

5. Shut down the host Linux VM so that it can be cloned.

6. Open the AWS Console and navigate to the EC2 | Instances list.

7. Right-click the entry for the Sensor VM and select Images and templates | Create image from the context menu that appears.

8. Use the AWS documentation to complete creation of the image(s). When the new image(s) restart they automatically generate new, unique Engine IDs and add themselves to the same Stellar Cyber platform as the source Sensor.

9. Authorize the cloned Sensors.

10. Restart the clone source Linux Sensor. It automatically generates a new Engine ID for itself and also must be reauthorized.