You need the following information:
Resource group name
Location (example: “westus”)
Size of the VM (for example, Standard_D16ds_v4)
NDR Console image
Name of this NDR Console virtual appliance (used in creating public IP name for the virtual appliance)
Data disk sizes in GB (up to 1023 GB per disk)
Number of required data disks
Name of storage account in which to store boot diagnostics
SSH public key for npadmin user
Names of the network interfaces created earlier
cloudinit.txt—A text file that you can use to specify settings that are applied for your NDR Console virtual appliance on the initial boot. For example: hostname, cluster.
Here is an example of cloudinit.txt file:
#cloud-config ia: hostname: IA1 cluster: name: IA1-es
Data disk number and sizes
The OS disk comes from the image itself and is 100 GB in size. You need to create one or more data disks for the NDR Console virtual appliance. You can specify the number and size of data disks in the same command you use to create the NDR Console virtual appliance.
Note
The number and size of disks required for your implementation depends on the needs of your deployment and your budget. A complete discussion is beyond the scope of this document.
In general, each disk can be up to 1023 GB in size. If you want to store more than 1 TB of data, you need more than one disk. Each VM size has a different limit on the number of disks you can attach. All data disks will be used by the NDR Console virtual appliance and will present a single, logical data disk.
Specify the size of each data disk as a space-separated value using the “--data-disk-sizes-gb” option. The following example creates an NDR Console with two 1000 GB disks to use as data disks by specifying “1000 1000”. (To specify a single 500 GB disk, you specify “500” for “--data-disk-sizes-gb”).
Creating the virtual machine
To create the virtual machine:
Use the following command.
az vm create --name <VMName> \
--image <IA-4.0.0.XXXXX> \
--resource-group <your-resource-group-name> \
--location westus \
--size Standard_D16ds_v4 \
--data-disk-sizes-gb 1000 1000 \
--boot-diagnostics-storage <storage-account-name>\
--admin-username <npadmin> \
--ssh-key-values <path/to/ssh/public-key> \
--nics <VMName-mgmt> \
--custom-data <cloudinit.txt>
When the operation is completed, the specified resource group contains a running NDR Console.
SSH Password Access
You can log on to it via SSH as follows:
ssh -i path/to/ssh/private.key npadmin@a.b.c.d
where “a.b.c.d” is the public IP address of the Network Detection and Response Console VM. You can find the public IP address in the Azure portal on the Overview tab of the new virtual machine.
For cloud deployments, there is no default password for the “npadmin” and “npscp” users. Use the key you provided above to log in to the Network Detection and Response Console using SSH. After logging in, you can reset the npadmin/npscp password and use it for other operations.