You can configure NX sensors from the NDR CLI to enable on-demand packet capture. Use the configure-nx command to provide the authentication credentials for the target NX sensor which enables you to start the packet capture function from the NDR.
To configure an NX sensor for packet capture:
Make sure you have attached the L7 metadata export on NX Sensor to your NDR. See Exporting NX L7 metadata for more details.
Log into the NDR CLI using a terminal window or SSH client.
Enter privileged mode on the NDR CLI. Enter the npadmin password, when prompted.
npadmin@hostname> enableEnter configuration mode.
npadmin@hostname> configure systemThe prompt changes to
npadmin@hostname(config)#on the terminal indicating that configuration mode is enabled.Run the
configure-nxcommand.It automatically queries the risky asset database table to discover NX sensors that have been identified as source devices. If one or more NX sensors are discovered, they are listed in a menu.
Select the target NX sensor to configure it for packet capture by providing its
UsernameandPassword. TypeXto save the configuration.Important
The authentication credentials provided must belong to a user with admin, operator, or analyst privileges on the NX sensor.
npadmin@hostname(config)# configure-nx Configure NX details ------------------------------------- 1) 10.x.x.x #) configure nx. X) Exit. Enter your choice: 1 Configure details for nx: 10.x.x.x ------------------------------------- 1. Username: <username> 2. Password: <password> ------------------------------------- X. Save and Return C. Cancel and Return #. Select profile field Enter your choice: X npadmin@hostname(config)#
Note
If no NX sensors are found, the command displays the message
no nx integrated to configure. Please enter to return.When an NX sensor is configured using this command, you can initiate the packet capture process for risky assets using the Asset Details page in the NDR Dashboard. See the section Managing assets for more information.