Version 19.0.2 Plixer
Total Page:16
File Type:pdf, Size:1020Kb
Scrutinizer Documentation Version 19.0.2 Plixer January 15, 2021 Scrutinizer 1 Deployment guides3 1.1 Virtual Appliance deployment guide............................3 1.2 AMI deployment guide................................... 34 2 System administration 41 2.1 Database backups..................................... 41 2.2 Changelog......................................... 45 2.3 Check vulnerabilities.................................... 59 2.4 Data aggregation...................................... 60 2.5 Support for distributed collectors............................. 64 2.6 Configuring Scrutinizer for dual/multi-homing...................... 65 2.7 Functional IDs....................................... 67 2.8 Getting started....................................... 69 2.9 Interactive CLI....................................... 69 2.10 Language translations................................... 91 2.11 Licensing.......................................... 92 2.12 Replicator load balancing................................. 93 2.13 Meta data collection.................................... 94 2.14 Predicting disk needs.................................... 95 2.15 Interactive CLI....................................... 96 2.16 Security updates...................................... 115 2.17 Sizing your environment.................................. 116 2.18 Configuring SSL in Scrutinizer.............................. 121 2.19 Streaming support for customer data lakes........................ 124 2.20 System LEDs........................................ 124 2.21 Third-party licenses.................................... 128 i 2.22 Upgrade guide....................................... 149 3 Machine learning 151 3.1 ML Engine AMI deployment guide............................ 151 3.2 ML Engine Virtual Appliance deployment guide..................... 152 3.3 Forecasting with Plixer Network Intelligence....................... 153 4 Integration guides 157 4.1 Advanced Threat Intelligence Feed............................ 157 4.2 Amazon Web Services flow logs.............................. 158 4.3 Elasticsearch / Kibana (ELK) integration......................... 162 4.4 Endace probe integration.................................. 166 4.5 Cisco’s FireSIGHT eStreamer client............................ 169 4.6 Grafana integration..................................... 175 4.7 Plixer Replicator load balancing.............................. 183 4.8 Scrutinizer for Splunk application............................. 185 4.9 Third-party integrations.................................. 189 4.10 Viptela SD-WAN...................................... 194 4.11 STIX-TAXII feeds..................................... 196 4.12 User name reporting - Active Directory integration.................... 197 4.13 User name reporting - Cisco ISE integration........................ 212 5 Migration guides 215 5.1 Migration utility...................................... 215 6 Scrutinizer API 225 6.1 IP Groups API....................................... 225 6.2 Reporting API....................................... 235 6.3 User API.......................................... 243 7 Dashboards 259 7.1 Overview.......................................... 259 7.2 Dashboard administration................................. 260 7.3 User and usergroup permissions.............................. 262 7.4 Vitals dashboard...................................... 264 8 Status 267 8.1 Overview.......................................... 267 8.2 Network traffic reporting.................................. 273 8.3 Flow view interface.................................... 284 8.4 Report thresholds...................................... 288 8.5 Scheduling a report..................................... 290 8.6 Run report options..................................... 293 8.7 Saved flows & host index searches............................. 295 ii 8.8 User name reporting.................................... 297 8.9 Flow Hopper........................................ 298 8.10 CrossCheck & Service Level reports............................ 298 8.11 Vitals reporting....................................... 301 9 Maps 305 9.1 Overview.......................................... 305 9.2 Groups........................................... 307 9.3 Objects........................................... 307 9.4 Connections........................................ 309 9.5 Creating Plixer maps.................................... 310 9.6 Creating Google maps................................... 314 10 Flow Analytics 317 10.1 Overview.......................................... 317 10.2 Algorithms and gadgets.................................. 319 10.3 Algorithm activation strategy............................... 334 10.4 Threat Index........................................ 336 10.5 Configuration........................................ 337 10.6 Custom algorithms..................................... 339 10.7 FA Bulletin Boards..................................... 343 11 Baselining 345 11.1 Overview.......................................... 345 11.2 Baseline reports...................................... 346 11.3 How baselining works................................... 346 11.4 Configuring baselines via the interactive scrut_util.................... 347 11.5 Adding/removing default exporter baselines........................ 347 11.6 Adding custom baselines.................................. 347 11.7 Monitoring baseline processing.............................. 349 11.8 Resetting baselines to defaults............................... 350 12 Alarms 351 12.1 Overview.......................................... 351 12.2 Views menu........................................ 352 12.3 Configuration menu.................................... 356 12.4 Reports menu........................................ 357 12.5 Bulletin board events.................................... 358 12.6 Editing policies....................................... 359 12.7 Creating thresholds and notifications........................... 361 13 Admin 367 13.1 Definitions......................................... 367 13.2 Settings........................................... 371 iii 13.3 Security........................................... 373 13.4 Managing devices and interfaces.............................. 381 13.5 Reports........................................... 385 13.6 Multi-tenant configuration................................. 388 iv Scrutinizer Documentation, Version 19.0.2 Welcome to the online manual. Please visit our online webcasts page which includes quick overviews (i.e. 2 - 5 minutes each) of specific features. Important: Don’t struggle, contact Plixer support! Scrutinizer 1 Scrutinizer Documentation, Version 19.0.2 2 Scrutinizer CHAPTER 1 Deployment guides 1.1 Virtual Appliance deployment guide 1.1.1 What you need to know about deploying a Plixer Scrutinizer Virtual Appliance The Plixer Scrutinizer Virtual Appliance can be obtained from Plixer or your local reseller. It is down- loaded as an all-in-one virtual appliance which can be deployed on an ESXi v5.5 and above or Hyper-V 2012 hypervisor. • You will need to obtain an appliance license or evaluation license from Plixer or your local reseller in order for the Plixer Scrutinizer Virtual Appliance to function properly. • It is recommended to give the Plixer Scrutinizer virtual machine NIC a static MAC address to pre- vent the machine ID from changing. This is especially important in clustered virtual environments where the VM can change hosts and MAC addresses. If the MAC address changes, the VM will need a new license key. 3 Scrutinizer Documentation, Version 19.0.2 • The Plixer Scrutinizer Virtual Appliance is deployed on a hypervisor server. It will use 100GB of disk space, 16GB of RAM, and 1 CPU with 4 cores. • The performance you get out of a Plixer Scrutinizer Virtual Appliance will be directly dependent on the hardware on which it’s deployed. It’s recommended to dedicate, not share, all the resources that are allocated to the Plixer Scrutinizer virtual machine. This is especially important for the Plixer Scrutinizer datastores. In environments with high volumes of NetFlow data, Plixer Scrutinizer will require dedicated datastores which are discussed in further detail later in this document. Plixer Scrutinizer hardware appliances are recommended for deployments of exceedingly high volume of flow as they are designed to handle the highest flow rates. • With the default of 100GB of disk space, you can store up to 1 month of NetFlow v5 data from 25 devices at 1,500 flows a second. If you’re planning on exceeding this volume of flow data, or if you need to store data for longer than 30 days, there are detailed steps indicated below that will show you how to expand the amount of disk space allocated to the appliance. • To enable the ability to shut down the Plixer Scrutinizer Virtual Appliance through vSphere, install VMware Tools using the instructions in this document. Using the “Power -> Off” method will result in database corruption. 1.1.2 System requirements The Plixer Scrutinizer Virtual Appliance has the following requirements: Component Minimum Specifications (for trial Recommended Specifications (for produc- installations) tion environments) RAM 16GB 64GB Disks 100GB 1+ TB 15K RAID 0 or 10 configuration Processor 1 CPU 4 cores 2GHz+ 2 CPUs 8 Cores 2GHz+ Operating ESXi 5.5+, Hyper-V 2012, KVM 14 ESXi 6+, Hyper-V 2012, KVM 16 System 1.1.3 Plixer Scrutinizer OVF deployment on ESX 1. Download the latest Plixer Scrutinizer Virtual Appliance 2. Using VMware vSphere, or vCenter, connect