This section describes how to launch a virtual NDR Console instance on AWS (Amazon Web Services).
Important
The navigation instructions and user interface may vary based on the AWS Management Console version that is running when you launch your instances.
Note
This procedure covers the required settings for a Trellix virtual appliance. You can accept the default values for the other settings, or specify values that are appropriate for your environment.
Go to the AWS login page and log in using your AWS ID.
Navigate to the AWS Management Console.
In the navigation bar, at the top of the console, select the region for the instance.
In the AWS services section, select EC2.
Click Launch Instance in the Create Instance section.
On the Choose an Amazon Machine Image (AMI) page, locate the AMI for the NDR Console instance. For example, locate " IA 4.0.0.xxxxx", then click Select.
On the Choose an Instance Type page, select one of the instance types listed in Instance requirements. Then click Next: Configure Instance Details.
On the Configure Instance Details page:
Select the management network and subnet from the Network and Subnet drop-down lists, and specify other settings provided by your network administrator. The management interface requires an external IP address and netmask.
Note
Specify an elastic IP address in the Primary IP field for the management interface (eth0) in the Network interfaces section at the bottom of the page. This enables external access to the instance.
Click Next: Add Storage.
On the Add Storage page:
Configure the Root device. Enter 120 in the Size (GiB) field and select General Purpose SSD (gp2) in the Volume Type field.
Click Add New Volume to add storage for the capture data. Select EBS in the Volume Type field, enter 16384 in the Size (GiB) field, and select Throughput Optimized HDD (st1) in the Volume Type field. At minimum 1.5 TB and maximum 16 TB per volume and a maximum of 2 volumes. Risk of data loss across as we strip across and EBS does not ensure no data loss occurs.
Repeat the previous step for each additional storage volume you need for anticipated bandwidth and retention.
Click Next: Add Tags.
(If required by your AWS administrator) On the Add Tags page, provide key and value combinations. Then click Next: Configure Security Group.
On the Configure Security Group page, select or add the security group that defines firewall rules that control traffic to the instance. At a minimum, include the security groups listed in Instance requirements. Consider limiting access beyond the default network displayed on the Configure Security Group page. Click Review and Launch.
Use Amazon's version of the cloud-init package to specify settings that are applied to the Network Detection and Response Console on the initial boot. You enter the data in the user data as described in Using cloud-init to configure Initial settings.
On the Review Instance Launch page, review the details about your instance. Click the appropriate Edit link if you need to make changes. When you are satisfied with the details, click Launch.
In the Select an Existing key pair or create a new key pair dialog box:
Select an existing pair or create a new one. To use the key pair you created when you were set up to use Amazon EC2, click Choose an existing key pair, and then select that key.
Important
Store the name of the key pair and the private key in a secure location.
Select the checkbox to confirm that you agree to the acknowledgement statement, and then click Launch Instances.
Note
You do not need to perform the initial configuration because the NDR Console instance is already configured with defaults that are applied during the first boot, and with settings that are optionally specified in user data before you launch the instance. You can then use the CLI or API to change settings as needed. For details, see the NDR Console System Administration Guide orTrellix API Reference Guide.