Installing the Data Processor in Azure Using Separate DL-m/DA-m VMs

This topic describes how to deploy the data processor (DP) with separate Data Lake Master (DL-m) and Data Analyzer Master (DA-m) VMs in Azure. This model also provides optional cluster support for deployment of additional DL and DA worker nodes as you need to scale up capacity and retention.

You can also deploy the DP as an all-in-one (AIO), with both the DL and the DA on the same VM. However, this model does not provide the efficiency and scalability of installing components on separate VMs. Stellar Cyber recommends using either the standard model described here or scaling up to a cluster.

Deployment Summary

Deployment of Stellar Cyber in Azure using separate DL-m and DA-m VMs consists of the following major steps:

Before You Begin

You must be signed in to Azure as an Owner to complete this procedure. This procedure assigns the Contributor role to the Stellar Cyber application, and assigning a role requires Owner privileges. A user signed in with only the Contributor role cannot complete the role assignment.

Make sure the target system meets the minimum system requirements for installing a DP. The installation requires:

  • An Azure subscription with sufficient budget authorization to deploy Stellar Cyber.

  • An Azure Resource Group, virtual network, and subnet for the deployment. The values you supply for these must already exist before you run the installation script.

  • An Azure Network Security Group.

  • Management IP addresses for all VMs:

    • 1 public IP address for each non- clustered DP (for management access).

    • 2 public IP addresses for each DP in a cluster (1 for management access, and 1 for the cluster).

    • 1 public IP address for each sensor, if the sensor will be receiving packets or logs from a sensor or application outside of Azure.

  • Open ports on your firewall

  • Login credentials and One Time Password (OTP) from Stellar Cyber

The internal network of the DP uses the 172.17.0.0/16 and 10.244.x.0/24 subnets. If you use these subnets elsewhere in your network, change them to avoid conflicts. If you cannot change them, contact Stellar Cyber technical support.

Firewall Ports

You must open ports on your firewall for communication.

When configuring the DP with separate VMs for the DL and DA (or in a cluster with additional worker nodes), all nodes must be in the same VNet and all ports between the nodes must be open in your firewall.

Open All TCP Ports Between Internal Addresses of Associated Stellar Cyber VMs

All TCP ports must be open between the internal network addresses of associated Stellar Cyber VMs, either in a cluster or a standard deployment with separate DL-m and DA-m VMs. For example, in a standard deployment with the DL-m on 172.31.7.0/24 and the DA-m on 172.31.10.0/24, the following rules must exist:

  • The DL-m must have a rule that allows all inbound TCP traffic from the 172.31.10.0/24 subnet.

  • The DA-m must have a rule that allows all inbound TCP traffic from the 172.31.7.0/24 subnet.

Stellar Cyber recommends that you add a firewall rule to allow all for clustered VMs (or just the DA and DL VMs in a standard deployment) and set the priority of that rule higher than the standard rule for the VNet.

One Time Password

Contact Stellar Cyber support (support@stellarcyber.ai) for login credentials and a one-time password (also known as a License Key).

You will need to provide:

  • The email address associated with your Azure subscription
  • The Azure region for the DP and sensors

Complete this step at least a day before installing so Stellar Cyber has enough time to deploy the images to your region.

After license activation, you can find the OTP for your installation in the Licensing page.

Supported Azure Regions

You must deploy the DP to one of the supported Azure regions listed below. Use the region's Programmatic Name when you supply the $location variable in the installation script.

Stellar Cyber supports the following Azure regions:

Geography

Region

Programmatic Name*

Asia Pacific

Southeast Asia

southeastasia

Brazil

Brazil South

brazilsouth

Canada

Canada Central

canadacentral

Europe

North Europe

northeurope

Europe

West Europe

westeurope

Germany

Germany West Central

germanywestcentral

Israel

Israel Central

israelcentral

Japan

Japan East

japaneast

United Kingdom

UK South

uksouth

United Kingdom

UK West

ukwest

United States

Central US

centralus

United States

East US

eastus

United States

East US 2

eastus2

United States

North Central US

northcentralus

United States

South Central US

southcentralus

United States

West Central US

westcentralus

United States

West US

westus

United States

West US 2

westus2

United States

West US 3

westus3

* Use the programmatic name for $location in the Azure installation script.

Minimum System Requirements

Refer to VM Specifications for Public Cloud Deployments (AWS, Azure, GCP, OCI) for details on the instance types and provisioning for the DL Master and DA Master in an Azure deployment.

Stellar Cyber only supports full-SSD deployments. Spinning-disk-based storage (HDD) and hybrid drives (SSHD) are not supported. All deployments must adhere to this SSD-only policy in order to qualify for performance guarantees and technical support.
Refer to Stellar Cyber Requires Full SSD Disks for further details.

Storage must meet or exceed the following sustained minimum performance metrics for 4KB random data operations:

  • Write IOPS: > 30,000

  • Read IOPS: > 60,000

  • Throughput: > 500 MB/s (read/write)