Introduction and requirements

Introductions and requirements for deploying a Vectra Brain appliance in KVM environments.

Introduction

This guide is intended to help customers or partners deploy a virtual Brain in environments running KVM-based virtualization, including Proxmox. A KVM Brain appliance can be used in Vectra AI Platform deployments that use either the Respond UX or the Quadrant UX. The Respond UX is served from Vectra’s cloud and the Quadrant UX is served locally from the Brain appliance. For more detail on Respond UX vs Quadrant UX please see Vectra Analyst User Experiences (Respond vs Quadrant).

This guide will cover basic background information, connectivity requirements (firewall rules that may be needed in your environment), licensing, deployment, and next steps. One of the below guides should be the starting point for your overall Vectra deployment:

• Vectra Respond UX Deployment Guide
• Vectra Quadrant UX Deployment Guide

About KVM Brain Images and Updates

The image(s) used to deploy a Brain in KVM are made available on the Vectra Customer Portal which is part of Vectra Support. Vectra periodically updates the base image(s) used for KVM Brain deployment. The different deployment pages in this article for Libvirt, Proxmox, or other KVM virtual machine managers include details on which image to select in the customer portal.

Please Note:

You must use a v9.14 or higher image for the KVM Brain deployment.

It is a best practice to always download the latest image from the Vectra Customer Portal prior to deployment of a new KVM Brain.

Brains that are connected to Vectra are updated automatically according to the settings on that Brain. Offline updates are also possible for Quadrant UX deployments only. Please see Offline Updates for instructions on how to apply offline updates.

KVM Brain Requirements and Performance

General Requirements

• DHCP environment configured to provide IP address subnet mask, and DNS server addresses for the Management interface of the Brain.
• Current login to a fully approved Vectra Support Portal account.

  • Accounts that are self-registered and not fully approved on the Vectra Support Portal will not have the license request option enabled.
• An open Proof of Value (Proof of Concept or Trial) that you are working with Vectra or a Vectra partner or a valid entitlement to Vectra NDR through purchase.

  • The licensing system cannot provide licenses for customers who are not currently entitled to a license through a trial or purchase.

Performance and KVM Requirements

For use in any Respond UX or Quadrant UX deployments:

Performance²	1 Gbps	4 Gbps	10 Gbps
CPU	8 Cores	16 Cores	32 Cores1
Memory	64 GB RAM	128 GB RAM	256 GB RAM
Drive (OS, Data) – Requires 260 MB/s	128 GB, 512 GB	128 GB, 512 GB	128 GB, 512 GB
Max Paired Sensors	15	25	100
Max Simultaneous Tracked Hosts3	25,000	50,000	150,000

Footnotes from above tables:

¹ Please see the 32 Core NUMA Configuration section of the deployment instructions for details on checking and setting (if required) for 32 core Brains.

² Performance represents the aggregate bandwidth observed on the capture interfaces of any Sensors that are paired to the Brain. Guidance is for average traffic mixes. Traffic mixes that skew toward larger flows (like file transfers) will perform better than traffic mixes that skew towards smaller flows (like DNS) as they produce more metadata.

³ Refers to how many hosts the Brain can track simultaneously (open host sessions). Brains retain and display data for larger numbers of hosts, this only refers to how many hosts the system can process metadata for simultaneously.

Please Note:

The virtual CPU MUST support the pdpe1gb cpu flag (1GB Large Pages) – More information, and a minimum SSE instruction level of 4.2, and must support the POPCNT (population count) instruction. This requires the hypervisor host to be running one of the following processors or later:

• Intel Nehalem (2008) processors and newer
• AMD Bulldozer (2011) processors and newer
• If your hypervisor is configured to hide these features, the brain will fail to process traffic.

Additional Notes:

• Vectra KVM based Brains do NOT support Mixed Mode deployment.

  • They can only be used in Brain mode.
• Vectra KVM based Brains support running in FIPS mode.

  • Note that the underlying hardware must also be FIPS compliant (it must support the RDRAND CPU instruction).
• Vectra recommends that Brains are configured to use storage local to the hypervisor and are not stored on a SAN.

  • Vectra Brains require extremely high throughput from their disk storage and this throughput cannot normally be sustained by SAN systems without impact to other SAN users.
• See KVM deployment details and considerations (the next section in this guide) for additional guidance around Storage/SANs, networking requirements, and unsupported hypervisors.