Post deployment guidance

Guidance for static addressing, updates, performance testing, integrity checks, configuration validation, licensing checks, and resizing your VMware Brain.

Setting a static IP and DNS after initial DHCP deployment

If you used DHCP for initial deployment but would like to configure a static IP for production use, you will need to login to the CLI of the Brain to set a static interface assignment. DNS for Brain VMs can be configured at the CLI or in the UI.

Logging in can be done via your hypervisor console function or using SSH to the management port if it was preconfigured with DHCP.

• Connect to your Brain CLI using your hypervisor console or ssh vectra@<IP or Hostname> if you use DHCP and already know the address or hostname.
• Once logged in to the Brain you can view command syntax for the set interface command:

set interface -h
Usage: set interface [OPTIONS] [mgt1] [dhcp|static] [IP] [SUBNET_MASK]
[GATEWAY_ADDRESS]
Sets mgt1 to either dhcp or static ip configuration
Options:
-h, --help Show this message and exit.

Setting the IP address statically

IPv6 is supported for the MGT1 interface. For full details, including information regarding dual stack support, please IPv6 Management Support for Vectra Appliances. Below we will show how to enable IPv6 support (its off by default) and the syntax to use when setting an IPv4 or IPv6 address.

To enable/disable IPv6 support:

# show ipv6 enabled
IPv6 is disabled
# set ipv6 enabled
Response: ok
# show ipv6 enabled
IPv6 is enabled
# set ipv6 disabled
Response: ok

Setting IPv4 and IPv6 syntax examples:

Execute the following command to set the MGT1 interface to the desired static IP address:

IPv4 Syntax:
set interface mgt1 static x.x.x.x y.y.y.y z.z.z.z
 
Where:
x.x.x.x is the desired interface IP address
y.y.y.y is the desired interface network mask
z.z.z.z is the desired gateway
 
IPv6 Syntax:
set interface mgt1 static [IPv6 IP] [Subnet Mask] [Gateway]
 
Example:
set interface mgt1 static 2001:0db8:0:f101::25 64 2001:0db8:0:f101::1

To change back to DHCP (default):

set interface mgt1 dhcp

Configure DNS for the appliance

Command syntax to set DNS (up to 3 nameservers are supported):

set dns [nameserver1 <ip>] [nameserver2 <ip>] [nameserver3 <ip>]

Example:

set dns 10.50.10.101 10.50.10.102

Verifying DNS Configuration:

show dns

To set DNS in the UI, navigate to Configuration → COVERAGE → Data Sources → Network → Brain Setup → DNS Entries and edit the settings.

Setting static IP and DNS at the CLI Example:

vscli > set interface mgt1 static 172.16.12.11 255.255.255.0 172.16.12.1
Interfaces updated successfully
vscli > set dns 10.50.10.101
DNS Set: success
vscli > show interface
mgt1:
    Running:
        Gateway: 172.16.12.1,
        Ip: 172.16.12.11,
        Link Speed: 10Gbps,
        Link State: up,
        Mac: 00:0c:29:89:ad:a6,
        Mode: static,
        Netmask: 255.255.255.0
vscli > show dns
Id|Server      |Description
1  10.50.10.101 Configured DNS nameserver

Performance testing

As discussed earlier in this guide, a performance test is run during the initial boot process. This is to test the performance of the Brain against baselines that Vectra has established for the different configuration options.

Cached results from the initial performance test run can be retrieved from the command line while logged in as the vectra user. Additional performance tests can be run by using the --force switch on the performance test command.

Please Note the Following:

Running the performance test is an intensive operation which takes down most services on the Brain.

• Additional performance tests should only be run when your security team knows the Brain will be unavailable.

  • Paired Sensors will buffer metadata that can’t be sent to the Brain so there should ultimately be no Detection gap, although this could introduce a delay in Detection publishing while the test is run.
• Baselines are set by Vectra for each of the various configurations of Brain.

  • Warning is for 10% below expectations. Critical is for 20% or more below expectations.

    • 260 MB/s is the minimum required throughput for all disks (OS and Data) and is represented by a score of 10.0 on the performance test in the disk category.
  • Critical is considered a failure and performance is not expected to be satisfactory. Vectra engineering considers systems which fail the performance test to be invalid configurations and customers should use more performant base hardware to ensure supportability, reliability, and performant operation.

Example:

vscli > performance-test --help
Usage: performance-test [OPTIONS]
 
Run a system performance test
 
Options:
--force Run all tests regardless of cached results.
-h, --help Show this message and exit.
 
vscli > performance-test
This may take up to five minutes. Most system services will be down for the duration of the test.
Test |Score |Result |Time
cpu 10.00 / 10.0 pass 30.04
cpu_steal 10.00 / 10.0 pass 0.06
disk 10.00 / 10.0 pass 47.94
memory 10.00 / 10.0 pass 0.00
memory_balloon 10.00 / 10.0 pass 0.05
overall 10.00 / 10.0 pass 78.09

Integrity checks

Vectra performs file system integrity checks to make sure that core libraries have not been altered. If the system detects changes during boot, a system setup and provisioning dialog will appear that is similar to the licensing screen.

• Click Set File System Configuration.
• Copy the Error Code and send it to Vectra support for decryption.
• Vectra has tooling to determine what has been changed, and if warranted can provide a whitelist code to the customer to allow the system to continue booting.
• Whitelist codes work one time. If the system again fails a file system integrity check, a new whitelist code will be required. Please work with Vectra support to ensure compliance.

Below are some example screenshots:

Configuration validation

During boot, the Brain determines which configuration it is running and sets some parameters differently depending on resource availability per configuration. This is an automatic process and requires no user input. Vectra may choose to support additional configuration options in the future.

Please work with your Vectra account team to provide feedback regarding additional configuration options that would be useful to your organization. The show system-health command can be run at the command line as the vectra user to see that your configuration is a supported option. Look for the [ OK ] VM Specifications. The specific checks shown may not match your system. Vectra occasionally updates the specific checks used in the system-health command.

Example:

vscli > show system-health
======== Ran 8 check(s). 8 Passed, 0 Failed, 0 No Result ========
vscli > show system-health --verbose
[ OK ] Available Virtual Storage Space
[ OK ] Disk Writable
[ OK ] NIC Detection
[ OK ] Vectra User Password
[ OK ] Sensor Connectivity
[ OK ] Sensor Link Utilization
[ OK ] Sensor Tunnel
[ OK ] VM Specifications

License checks and renewal

Once a Brain is up and running, it will periodically check its license status. This will occur whether the Brain is online or offline (from the perspective of connection to Vectra). Once a Brain is 30 days from expiration, it will begin to send syslog messages with a count down until expiration. Once the license expires a new syslog message is sent (Quadrant UX). Respond UX deployments will write the message to the audit log which is available for query via API.

Here are examples:

License Checker: Detect License Expires in {days_until_expiration} days.

License Checker: Detected Invalid/Expired License, disabling services

The status of your license can be seen in the following locations in the Vectra UI:

• Configuration → SETUP → Licensing
• Discover → PLATFORM → System Health → Deployments

  • If you license status does not show, click the Update Now button at the bottom of the section.

Examples:

Configuration → SETUP → Licensing:

Discover → PLATFORM → System Health → Deployments:

For Brains that are connected to Vectra, license renewal is an automated process that requires no user intervention. When you sales contract is renewed and the expiration date is updated, Vectra’s provisioning service will provide a new license key to your Brain.

If your Brain is offline (not connected to Vectra or air-gapped), to renew your Vectra license simply browse to the Configuration → SETUP → Licensing screen, copy the authorization code, provide it to Vectra (support, sales team, etc), and Vectra will provide you a new license key for entry into the UI once your entitlement is verified.

Resizing the Brain

In some environments, you may wish to start with a smaller Brain instance and then later move to a larger Brain instance to handle additional load (metadata coming from paired sensors or additional paired sensors).

• Please see: Resizing Virtual Sensors and Brains for details.

Next Steps

At this point your virtual Brain is fully deployed and you can move on to other tasks associated with your overall deployment.

It is recommended to follow the Vectra Respond UX Deployment Guide or Vectra Quadrant UX Deployment Guide for additional information regarding initial settings for your deployment. You may wish to deploy and pair network Sensors or configure other Vectra offerings such as Recall, Stream, CDR for M365, IDR for Azure AD, CDR for AWS, etc. Additional deployment documentation can be found on the left hand side of this site in the Deployment section.

• Support portal: https://support.vectra.ai
• Email: [e-mail] (preferred contact method)
• Additional information: https://www.vectra.ai/support