Implementation Guide

Introduction

This article is to provide guidance for customers to plan, execute, and maintain a BluVector Advanced Threat Detection (ATD) deployment.

BluVector ATD identifies cyberattacks prior to entering a network. The BluVector ATD Features include:

• Analysis of network traffic and files in real time

• Detection of fileless threats through speculative code execution

• Machine learning that adapts and learns about unique content in your network

• Enhanced Zeek logs that provide detailed records of network connections

• Configurable risk levels

• Privacy, with no requirement to share data with BluVector

This article focuses on device implementation to maximize the use of the BluVector ATD product within security organizations.

This document is intended to supplement the BluVector ATD User Manual. Where appropriate, procedures documented in the user manual should be used.

Feedback related to BluVector ATD implementation can be provided to a Customer Success point of contact or by email to support@bluvector.io.

Preinstallation Checklist

This section provides yes or no questions to help a customer plan for a BluVector ATD deployment. It is recommended to complete the checklist as early as convenient, to provide ample time to resolve potential implementation issues.

The questions are broken up into the following categories:

• Logistics

• Physical Installation

• Appliance Configuration

• Network Integration

Logistics

Table 1: Preinstallation Logistics Questions

Physical Installation

Table 2: Preinstallation Physical Installation Questions

Appliance Configuration

Table 3: Preinstallation Appliance Configuration Questions

Network Integration

Table 4: Preinstallation Network Integration Questions

Welcome Kit (What’s in the Box)

A delivered BluVector ATD appliance contains the following in the box:

1. Standard Rail Kit

2. Six (6) foot (IEC-320-C19 to IEC-320-C20) power cables

3. Appliance (FX-2 or R440)

4. SFP Kit (Applicable to FX-2 appliances)

Physical Installation

This section describes the process to install a BluVector ATD appliance. The procedures are separated for the two different appliance form factors:

• R440 (500 Mbps and 1 Gbps)

• FX-2 (5 – 40 Gbps)

Appliances are shipped in Dell packaging and are preconfigured with the BluVector ATD software. See the Welcome Kit (What’s in the Box) section for further details on the delivered hardware.

R440 Install Procedure

• Unpack the system.

• Install the 1U Dell Poweredge Rack Rails into the server rack.

• Install the Dell R440 in the Rack Rails.

• Insert the two power cords into the dual power supplies and into the power strips in the rack.

• Connect an ethernet cable to the following connections on the backside of the server:

  • Integrated Dell Access Console or “iDRAC” - upper left-hand port

  • Management switch – the port to the right of the iDRAC.

  • Ingest port – below the management port. This port should be connected to the tap or packet broker.

Figure 1 shows the back panel of the R440 with the labeled data connections.

Figure 1: R440 Back Panel

FX-2 Install Procedure

• Unpack the system.

• Install the 2U Dell Poweredge Rack Rails into the server rack.

• Install the Dell FX2 server in the rack rails.

• Insert the two power cords into the dual power supplies and into the power strips in the rack.

• Connect an ethernet cable to the Chassis Management Controller (CMC) interface. This physical interface is for the CMC and each node’s iDRAC connections.

• For each node perform the following:

  • Connect a cable to the node’s management port.*

  • Connect a cable to the node’s ingest port.*

*The physical interface type will be either copper or fiber, depending on the SFP type used.

Figure 2 shows the back panel of FX-2 chassis with the CMC connection highlighted.

Figure 2: FX-2 Back Panel - CMC Connection

Figure 3 shows the back panel of the FX-2 chassis with the A1 and A2 modules highlighted. The A1 module is reserved for connections to the management interface, and A2 is reserved for the ingest interface.

Figure 3: FX-2 Back Panel - A1 and A2 Modules

The FX-2 can hold up to four separate compute nodes. For each module, connection numbers 1, 3, 5, and 7 as shown in Figure 3 map to nodes 1, 2, 3, and 4, respectively.

BluVector ATD Appliance Configuration

This section describes the method to configure the following on a BluVector ATD appliance:

• IP Address(es)

• NTP

• DNS

IP Address Configuration – Chassis Management Controller

The Chassis Management Controller (CMC) connection is only available on the multi-node FX-2 hardware. To configure the CMC interface’s IP address, perform the following:

1. Connect a network cable into the iDRAC port as shown in Figure 2.

2. Set up the IP address on the computer for which you are configuring the appliance to the following settings:

   1. IP Address – Any IP address in the 192.168.0.x/24 network except 192.168.0.120

   2. Default Gateway – 192.168.0.1

3. Open a web browser on the workstation and navigate to https://192.168.0.120.

4. Login with the following credentials:

   1. Username: root

   2. Password: calvin

   

   Figure 4: CMC Login Interface

5. Select Network from the menu.

   

   Figure 5: CMC Health Status

6. Under network configuration, choose the appropriate IP settings to configure (IPv4 or IPv6).

   

   Figure 6: IPv4 CMC Settings

7. After making the required IP configuration changes, select Apply Changes to save the configuration. The appliance will now be accessible via a browser at the newly configured IP address.

IP Address Configuration – iDRAC (FX-2)

The iDRAC IP address for the individual nodes in a FX-2 chassis are configured via the CMC interface. To configure the IP address from the CMC, perform the following:

1. In the CMC main page, navigate to Chassis Controller > Server Overview and select Setup.

   

   Figure 7: iDRAC IP Setup from CMC

2. Complete the networking setup in the Quick Deploy Settings to set the IPv4 or IPv6 values.

3. Select Apply iDRAC Network Settings at the top of the menu pane to save the settings.

IP Address Configuration – iDRAC (R440)

To configure the IP address of an R440’s iDRAC interface, perform the following:

1. Connect a network cable into the iDRAC port as shown in Figure 1.

2. Set up the IP address on the computer for which you are configuring the appliance to the following settings:

   1. IP Address – Any IP Address in the 192.168.0.x/24 network except 192.168.0.120

   2. Default Gateway – 192.168.0.1

3. Open a web browser on the workstation and navigate to https://192.168.0.120

4. Login with the following credentials to enter the iDRAC Dashboard:

   1. Username: root

   2. Password: calvin

   

   Figure 8: iDRAC Dashboard

5. Select iDRAC Settings.

   

   Figure 9: iDRAC Settings

6. Configure the IP address for either IPv4 or IPv6.

   

   Figure 10: iDRAC Network Configuration

7. Select Apply to save the changes.

IP Address - Management

The IP address for the management interface is set in the terminal of the Operating System in the iDRAC GUI. To change the management IP address, perform the following:

1. Navigate to the iDRAC GUI and login with the following credentials:

   1. Username: root

   2. Password: calvin

2. In the iDRAC Dashboard, open up a terminal by selecting Launch Virtual Console.

   

   Figure 11: iDRAC Dashboard - Launch Console

3. When a command prompt appears, login with the following default credentials:

   1. Username: bvadmin

   2. Password: bluvector

4. From the terminal prompt as user bvadmin, perform the following commands to set the IPv4 addresses. For the interface, item in the commands below will be either em1 or System em1 values.

   • nmcli connection modify <interface> ipv4.addresses <ip>/<mask length>

   • nmcli connection modify <interface> ipv4.gateway <gateway>

   • nmcli connection modify <interface> ipv4.method manual

   • nmcli connection down <interface> && nmcli connection up <interface>

5. For IPv6, the commands are:

   • nmcli connection modify <interface> ipv6.addresses <ip>/<mask length>

   • nmcli connection modify <interface> ipv6.gateway <gateway>

   • nmcli connection modify <interface> ipv6.method manual

   • nmcli connection down <interface> && nmcli connection up <interface>

As an alternate, the user can set the IP address for the management interface via a Keyboard, Video, and Mouse (KVM) or crash cart local to the appliance.

DNS / NTP

To configure DNS and NTP connections to an appliance, perform the following from the terminal:

1. If not already logged in, log in as bvadmin from the appliance terminal.

2. To set up DNS, perform the following commands:

   • nmcli connection modify <interface> ipv4.dns <dns servers separated by commas>

   • nmcli connection modify <interface> ipv4.dns-search <local domain>

3. To set up the Network Time Protocol, use vi or vim to edit the chrony.conf file:

   • vi /etc/chrony.conf

4. Add the following line to the end of the file, using the NTP server for the host value:

   • server <host> iburst

5. Restart the chrony service by running the following:

   • systemctl restart chronyd.service

   • sudo chronyc online

Customer Network Integration

This section details the services, ports, and protocols for BluVector ATD network connectivity. Use the list to ensure that the settings are configured for various network access control lists (ACLs) and firewall rules for proper system functionality.

The BluVector Portal is the cloud gateway for communicating with the BluVector Cloud infrastructure for the services listed in Table 5. These services are optional and can be disabled.

Table 5: BluVector Portal Service Configuration

The services listed in Table 6 are BluVector Portal services that can be accessed for off-line customers.

Table 6: BluVector Portal Off-Line Service Configuration

BluVector ATD System

Table 7 lists the services, ports, and protocols that are needed for BluVector ATD system connectivity with:

• BluVector Central Managers

• User containers and add-ons

• Collectors

• Other services

Table 7: BluVector ATD System Service Connectivity

Table 8 lists the services, ports, and protocols that are needed for optional third-party product integrations for:

• Email monitoring

• Threat intelligence

• Data forwarding

• Post analyzers / sandboxes

• Endpoint solutions

Table 8: BluVector ATD Third-Party Integration Connectivity