Technical overview of virtual NDR Console deployment in AWS

The virtual NDR Console deployment in AWS is via an AMI (Amazon Machine Image). The virtual AMI is essentially an EC2 image with the base CentOS operating system and any NDR Console-specific or dependent RPMS, plus security hardening applied.

The virtual NDR Console deployment in AWS has some differences from other virtual deployments:

Network address

When a virtual NDR Console is provisioned in AWS, the EC2 instance can be preassigned a custom, private IP address from the pool of addresses on the configured subnet. This helps to ensure that the connection established between an NDR Console and a paired PX instance is not interrupted when the system restarts. No additional configuration is required on the NDR Console. The DNS name of the instance will also be assigned automatically from the pool. Both the IP and DNS name can be seen in the AWS UI.

For more information on how to assign a custom private IP address, refer to the AWS documentation at https://aws.amazon.com/premiumsupport/knowledge-center/custom-private-primary-address-ec2/

Using cloud-init

The NDR Console virtual appliance leverages the standard cloud-init 18.2 RPM to perform the configuration of the appliance at boot. Cloud-Init is the utility for customizing a virtual machine at boot time across multiple cloud environments where the cloud-specific configuration is abstracted into a common, extensible API. The cloud-init JSON data can be pasted into the user data section of the AWS UI when you configure the EC2 instance.

To enable automation of the provisioning of cloud appliances, the first-run script needs to be executed when the instance boots. The first run is completely automated and depends on a user-defined configuration that must be provided to the VM through user-data in YAML format. The first-run process is slightly modified from the standard first run that is executed when a user first logs in to configure a physical appliance. The basic provisioning of an appliance requires a hostname as well as a cluster name for the underlying search index cluster. The first-run initialization performed by cloud-init is the same process that is used the first time you boot a physical appliance. See Using cloud-init to configure initial settings.

Storage

Although Amazon has multiple storage options available for virtual appliances, Trellix recommends only two storage options for an NDR Console cluster to ensure optimal performance and availability of the underlying search index. The first, most expensive option is Provisioned IOPS SSD (io1), which is backed by Amazon's EBS (Elastic Block Store). This storage option provides the highest levels of throughput and allows users to specify the IOPS (Input/Output Operations per Second) in addition to the storage size based on their organization's needs. Although EBS-backed storage is limited to 16 TB per volume, multiple volumes can be attached to an instance at launch and will be allocated to the search index disk partition. Given that EBS provides redundancy and persistence across restarts, it provides the best availability option. Additionally, a bootable AMI can be created from an io1 snapshot in the case of a root volume failure.

The second storage option, Throughput Optimized HDD, is also an EBS-backed volume. It provides limited throughput rates, with a maximum rate of 500 MiB/s. You can also configure the volume size to suit your data retention needs, up to a limit of 16TB. This option cannot be used as a boot volume. Configuring the NDR Console to run on ephemeral, physically connected storage is not advised because there is no built-in replica support for the search index; therefore, data loss is possible.

Trellix recommends that you configure the virtual NDR Console with at least two separate EBS volumes: one volume configured for the root and another configured for data storage. All index information is written to the storage index as well as any pending PX flow/event records. A minimum of 1.5 TB should be provisioned for the storage volume. The actual storage to be provisioned should be decided based on the data retention requirements.