Scrutinizer Documentation Version 18.18 Plixer
Total Page:16
File Type:pdf, Size:1020Kb
Scrutinizer Documentation Version 18.18 Plixer February 18, 2020 Scrutinizer 1 Deployment guides3 1.1 Virtual Appliance deployment guide............................3 1.2 AMI deployment guide................................... 42 2 System administration 51 2.1 Getting started....................................... 51 2.2 Changelog......................................... 52 2.3 Licensing.......................................... 61 2.4 Meta data collection.................................... 62 2.5 System LEDs........................................ 63 2.6 Functional IDs....................................... 66 2.7 Data aggregation...................................... 68 2.8 Configuring SSL in Scrutinizer.............................. 71 2.9 Database backups..................................... 73 2.10 Upgrade instructions.................................... 77 2.11 Interactive scrut_util.................................... 80 2.12 Configuring Scrutinizer for dual/multi-homing...................... 101 2.13 Support for distributed collectors............................. 103 2.14 Check vulnerabilities.................................... 104 2.15 Security updates...................................... 105 2.16 Language translations................................... 106 2.17 Third-party licenses.................................... 107 3 Integration guides 129 3.1 Configuring Amazon Web Services Flow Logs...................... 129 3.2 Cisco’s FireSIGHT eStreamer client............................ 131 i 3.3 Elasticsearch / Kibana (ELK) integration......................... 138 3.4 Scrutinizer for Splunk application............................. 142 3.5 Endace probe integration.................................. 146 3.6 Viptela SD-WAN...................................... 149 3.7 Third-party integrations.................................. 150 3.8 User name reporting - Active Directory integration.................... 156 3.9 User name reporting - Cisco ISE integration........................ 171 4 Migration guides 175 4.1 Migration utility...................................... 175 5 Scrutinizer API 185 5.1 Using the IP Groups API.................................. 185 5.2 Using the reporting API.................................. 193 5.3 Using the user API..................................... 210 6 Dashboards 223 6.1 Overview.......................................... 223 6.2 Dashboard administration................................. 224 6.3 User and usergroup permissions.............................. 226 6.4 Vitals dashboard...................................... 228 7 Status 231 7.1 Overview.......................................... 231 7.2 Network traffic reporting.................................. 237 7.3 Flow view interface.................................... 248 7.4 Report thresholds...................................... 252 7.5 Scheduling a report..................................... 254 7.6 Run report options..................................... 257 7.7 Saved flows & host index searches............................. 259 7.8 User name reporting.................................... 261 7.9 Flow Hopper........................................ 262 7.10 CrossCheck & Service Level reports............................ 262 7.11 Vitals reporting....................................... 265 8 Maps 269 8.1 Overview.......................................... 269 8.2 Groups........................................... 271 8.3 Objects........................................... 271 8.4 Connections........................................ 273 8.5 Creating Plixer maps.................................... 274 8.6 Creating Google maps................................... 278 9 Flow Analytics 281 ii 9.1 Overview.......................................... 281 9.2 Algorithms and gadgets.................................. 283 9.3 Algorithm activation strategy............................... 296 9.4 Threat Index........................................ 297 9.5 Configuration........................................ 298 9.6 Custom algorithms..................................... 300 9.7 FA Bulletin Boards..................................... 304 10 Baselining 307 10.1 Overview.......................................... 307 10.2 Baseline reports...................................... 308 10.3 How baselining works................................... 308 10.4 Configuring baselines via the interactive scrut_util.................... 309 11 Alarms 313 11.1 Overview.......................................... 313 11.2 Views menu........................................ 314 11.3 Configuration menu.................................... 318 11.4 Reports menu........................................ 319 11.5 Bulletin board events.................................... 320 11.6 Editing policies....................................... 321 11.7 Creating thresholds and notifications........................... 323 12 Admin 329 12.1 Definitions......................................... 329 12.2 Settings........................................... 333 12.3 Security........................................... 335 12.4 Managing devices and interfaces.............................. 341 12.5 Reports........................................... 344 12.6 Multi-tenant configuration................................. 347 iii iv Scrutinizer Documentation, Version 18.18 Welcome to the on-line manual. Click Here for online troubleshooting or FAQs. There are also online webcasts which give quick overviews (i.e. 2 - 5 minutes each) of specific features. Important: Don’t struggle, contact Plixer support! Scrutinizer 1 Scrutinizer Documentation, Version 18.18 2 Scrutinizer CHAPTER 1 Deployment guides 1.1 Virtual Appliance deployment guide 1.1.1 What you need to know about deploying a Scrutinizer Virtual Appli- ance The Scrutinizer Virtual Appliance can be obtained from Plixer or your local reseller. It is downloaded as an all-in-one virtual appliance which can be deployed on an ESXi v5.5 and above or Hyper-V 2012 hypervisor. • You will need to obtain an appliance license or evaluation license from Plixer or your local reseller in order for the Scrutinizer Virtual Appliance to function properly. • It is recommended to give the Scrutinizer virtual machine NIC a static MAC address to prevent the machine ID from changing. This is especially important in clustered virtual environments where the VM can change hosts and MAC addresses. If the MAC address changes, the VM will need a new license key. 3 Scrutinizer Documentation, Version 18.18 • The Scrutinizer Virtual Appliance is deployed on a hypervisor server. It will use 100GB of disk space, 16GB of RAM, and 1 CPU with 4 cores. • The performance you get out of a Scrutinizer Virtual Appliance will be directly dependent on the hardware in which it’s deployed on. It’s recommended to dedicate, not share, all the resources that are allocated to the Scrutinizer virtual machine. This is especially important for the Scrutinizer datastores. In environments with high volumes of NetFlow data, Scrutinizer will require dedicated datastores which are discussed in further detail later in this document. Scrutinizer hardware appli- ances are recommended for deployments of exceedingly high volume of flow as they are designed to handle the highest flow rates. • With the default of 100GB of disk space, you can store up to 1 month of NetFlow v5 data from 25 devices at 1,500 flows a second. If you’re planning on exceeding this volume of flow data, or if you need to store data for longer than 30 days, there are detailed steps indicated below that will show you how to expand the amount of disk space allocated to the appliance. • To enable the ability to shut down the Scrutinizer Virtual Appliance through vSphere, install VMware Tools using the instructions in this document. Using the “Power -> Off” method will result in database corruption. 1.1.2 System requirements The Scrutinizer Virtual Appliance has the following requirements: Component Minimum Specifications (for trial Recommended Specifications (for produc- installations) tion environments) RAM 16GB 64GB Disks 100GB 1+ TB 15K RAID 0 or 10 configuration Processor 1 CPU 4 cores 2GHz+ 2 CPUs 8 Cores 2GHz+ Operating ESXi 5.5+, Hyper-V 2012, KVM 14 ESXi 6+, Hyper-V 2012, KVM 16 System 1.1.3 Scrutinizer OVF deployment on ESX 1. Download the latest Scrutinizer Virtual Appliance 4 1. Deployment guides Scrutinizer Documentation, Version 18.18 2. Using VMware vSphere, or vCenter, connect to the ESX host where you will deploy the Scrutinizer Virtual Appliance 3. Go to File > Deploy OVF Template 4. Select “Local file” and browse to the downloaded Scrutinizer OVF file and the Scrutinizer VMDK file, then click “Next”. 1.1. Virtual Appliance deployment guide 5 Scrutinizer Documentation, Version 18.18 5. Give your Scrutinizer VA a name and press “Next”. 6. Select an ESX to deploy the machine on if your host is not already selected and press “Next”. 6 1. Deployment guides Scrutinizer Documentation, Version 18.18 7. Review the details of the virtual machine and press “Next”. 8. Select your datastore, set your disk format to “Thin Provision” and press “Next”. Note: Be sure to read the Optimizing Scrutinizer Datastores section to obtain the best performance and collection rates. 1.1. Virtual Appliance deployment guide 7 Scrutinizer Documentation, Version 18.18 9. Select the network to be used by the Scrutinizer Virtual Appliance. 10. A summary of the options you chose will appear. Click “Finish” and it will import the Scrutinizer Virtual Appliance. This can take a few moments. 8 1. Deployment