Creating a client group using the CLI

Before you begin

Make sure that you have set up the NDR appliance and configured one or more required client profiles on it using the NDR CLI. For more information, refer to the topic Creating a client profile using the CLI.

Log into the NDR CLI using a terminal window or SSH client:
1. Using the SSH protocol, log into the appliance with management interface's IP address or hostname.
```
$ ssh npadmin@<NDR IP address>
```
2. Enter the password when prompted. The hostname > prompt is displayed after you have logged in.
Enter privileged mode on the NDR CLI.
```
npadmin@hostname> enable
```
Enter the npadmin password, when prompted. The password can be 5 to 24 characters long.
```
[sudo] password for npadmin: <password>
```
Enter configuration mode.
```
npadmin@hostname# configure system
```
The prompt changes to npadmin@hostname(config)# on the terminal indicating that configuration mode is enabled. You can now proceed with the Client Profile configuration task.
Type client-group at the terminal and press Enter.
The Client Group configuration options are displayed in the Group(s). page
Note
You can configure up to 10 client groups on an appliance using its CLI.
To add a new client group, type A in the Enter your choice field and press Enter. Add new group page is displayed with the configuration options.
Type 1 and press Enter to create a name for the client group. Enter the name of the group in the Enter group name field and press Enter. The name given will now reflect in the Name section.
Type 2 and press Enter to assign a client profile to the client group being configured. The Profile(s) page is displayed with the list of client profiles configured. To specify a client profile, type the numeric value assigned to the profile and press Enter. The client profile name will now reflect in the Profile field under the Add new group page. Or, Enter C and then press Enter to go back to the previous Add new group page menu.
On Add new group page menu, type 3 and press Enter to set up the polling interval in minutes. This polling interval duration is used by both the Manager and Sensors to retrieve the configuration and filter parameters from the client profile assigned and apply the configuration or any changes made in the configuration to the alert data and flow data before exporting it to the NDR appliance, when it is integrated.
Provide the Polling interval value in minutes. You can enter any number between 30 to 1440. Once set, the value assigned will reflect in the Add group name page menu.
Note
The default polling interval is set to 30 minutes.
Type 4 and press Enter to enable the flow whitelist(count). Flow Whitelist page displays the flow whitelist parameters that are part of a particular flow. When these flows are added to whitelist, NDR will ignore these flows and will not generate alerts for these flows.
Type 5 and press Enter to enable the metadata engine(s). Configure detection engines page displays the metadata engines. The metadata engines are disabled by default and shows N to reflect the disabled status. You can choose to enable any detection engine as per your investigation requirement.
To enable a specific detection engine:
1. Type the numeric value assigned to that engine and press Enter. The status of the engine changes to Y to reflect the enabled mode. For example, from the engine configuration page, you need to type 3 and press Enter to enable Data Exfiltration Engine that allows you to monitor alerts generated by this engine on the NDR Web UI and identify any data extraction patterns or possible malicious data exfiltration attack over your network. Repeat the same procedure for any other detection engine you want to enable.
2. To save and return to the Add new group page menu, type X and press Enter. Or, type C and press Enter to abort the changes made and return to the Add new group page menu. The names of the metadata engine(s) enabled reflect in the Add group name page menu.
Type 6 and press Enter to enable the home network. Type the CDR format of the home network for which NDR appliance will not generate alerts for the configured home network.
Type X and press Enter to save the changes and finish the client group configuration task. A message confirming the addition of the group is displayed. Press Enter to go back exit the Add new group page menu. In case you do not want to proceed with the client group configuration changes, type C and press Enter. This will cancel all the configurations made for the group and redirects back to the Group(s) page.
The Group(s) page is displayed with the configured client group in the list.
Type 7 and press Enter to add the PX host(s). The PX Host(s) page is displayed. To add a PX host to the Client Group, type A and press Enter. Specify a PX host by typing the numeric value assigned to the host's IP address and press Enter. You are directed to the PX Host(s) page which now reflects PX host IP address chosen by you.
Enter the numeric value assigned to the client group configured in the Enter your choice field and Press Enter.
The group-specific details is displayed on the terminal. Note down the authentication hash token of 32 bytes and the client group name. This token will be required while configuring L7metadata export and alerts export on different devices such as NDR sensor, IPS manager, EX, AX, and CMS.