Collectors

• 1: Samurai Local Collector
• 2: Samurai Cloud Native Collector

1 - Samurai Local Collector

If you have determined that you require a local collector then follow the steps below to learn what you need to get started, create, configure and download a local collector from the Samurai MDR portal and ensure it is working as expected.

1. Take a moment to understand what you need to get started
2. Create, configure and download a Collector
3. Install a Collector
4. Validate Collector Status
5. Collector Status Notifications
6. What’s next?
7. Deleting a Collector

What you need to get started

• Access to the Samurai MDR portal and your specific tenant.

• A hypervisor to run the virtual machine, for example VMware vSphere, Microsoft Hyper-V, Amazon EC2 or Azure Virtual Machine

  • View virtual machine requirements below.

• Ensure to make any necessary updates to comply with the collectors connectivity requirements.

• A static IP address for the collector and DNS server IP addresses unless you decide to use DHCP.

• Access to your products to make necessary changes outlined within the relevant integration guide.

Minimum Virtual Machine Requirements

The following machine requirements will support up to 15K events per second (EPS) peak, 10K EPS sustained over a 24hr period, approx 800GB per day.

Connectivity required for the Collector

The collector requires connectivity to resources outlined within the table below, you may need to update your security controls e.g firewall to allow this connectivity.

Create, Configure and Download a Collector

1. From your Samurai MDR portal tenant, click Telemetry and select Collectors from the main menu

2. Select Create Collector

3. Select Local collector

4. Complete the fields as required.

5. Select Create Collector once you have completed all relevant fields

6. Select the Collector you created by clicking the Name used in Step 2

7. Select Download

• The files you need to download are based on your Hypervisor. The options available for download are:

  • Configuration
    • iso - configuration file for your collector, this file is always required
  • Cloud init
    • AWS - used to provide cloud-init data to AWS instance
    • Azure - used to provide cloud-init data to Azure instance
  • Virtual machine
    • vmdk - disk image (not needed if using the ova)
    • vhdx - virtual hard disk format used for Hyper-V
    • ova - virtual machine that the collector will run (includes disk image) for VMware

8. Download the iso configuration file and also the relevant file needed for your hypervisor.

If you are creating multiple collectors, you only need to download the ova file once and can use it multiple times, the important file per collector is the configuration file (iso).

Install a Collector

Based on your hypervisor follow the relevant section:

• VMware vSphere
• Microsoft Hyper-V
• Amazon EC2
• Azure Virtual Machine

VMware vSphere

Follow the documentation from VMware:

• Deploy a Virtual Machine from an OVF or OVA File in the VMware Host Client

1. When asked to provide a virtual machine name, we suggest samurai-nttsh-collector
2. Be sure to select the .ova file you downloaded when asked for the file to deploy your virtual machine from.

Once complete follow the VMware article to configure a datastore ISO file

• Configure a Datastore ISO File for the CD-DVD

1. Be sure to select the .iso file you downloaded when asked to select file

The VM is now ready to be powered on.

The .iso file must be mounted at first boot to configure the Collector. Once you have validated the Collector status is Healthy in the Samurai MDR portal you must ensure the .iso is dismounted.

Microsoft Hyper-V

Follow the documentation from Microsoft:

• Create a virtual machine in Hyper-V

1. When asked to provide a virtual machine name, we suggest samurai-nttsh-collector
2. Use the Virtual Machine Requirements when configuring memory and network
3. When asked to Connect Virtual Hard Disk ensure to use the .vhdx file you previously downloaded
4. For Installation Options ensure you use the .iso file you previously downloaded

Once you have completed setup of your Collector you should ensure it is running and validate the status within the Samurai MDR portal, upon initial setup this can take a little while.

Amazon EC2

Prerequisitve steps:

1. Ensure you have the AWS cloud-init.yaml file you downloaded from Create, Configure and Download a Collector.. This file will be used later during EC2 instance deployment.

Follow the vendor documentation from Amazon to launch a EC2 instance:

• Launch an instance

Perform the following adjustments to the vendor documentation when launching the instance:

1. During step 4.a, select Ubuntu as AMI.

2. During step 4.b*,* select the latest Ubuntu AMI

3. During step 5*,* select a suitable Instance Type based on estimated performance requirements while fulfilling the Minimum Virtual Machine Requirements.

4. During step 6 & 7, Set Key pair & Network Settings as per your AWS policies. Ensuring the the Network settings still fulfills the Connectivity required for the Collector.

5. Before step 8, modify the Configure storage section with the following settings:

   1. Adjust the Root Volume to be at least 64 GiB.
   2. Add a secondary volume with at least 500 GiB according to the Minimum Virtual Machine Requirements.
      Secondary disk volume will be used for spooling, size it according to estimated log volume and max downtime.

6. Before step 8, expand the section Advanced details and paste in the content of the cloud-init.yaml file into the User data section. Ensure that the check box User data has already been base64 encoded is not enabled.

7. Proceed with step 8 and finish the rest of the installation as per the vendor documentation.

Azure Virtual Machine

Prerequisite steps:

1. Ensure you have the Azure cloud-init.yaml file you downloaded from Create, Configure and Download a Collector.. This file will be used later during the Virtual Machine instance deployment.

Follow the vendor documentation from Microsoft to launch a Virtual Machine instance:

• Create a virtual machine

Perform the following adjustments to the vendor documentation when launching the instance:

1. Under the Basic tab, select Ubuntu Server 22.04 LTS as image
2. Under the Basic tab, select a suitable Size based on estimated performance requirements while fulfilling the Minimum Virtual Machine Requirements.
3. Under the Disk tab, add one data disk with at least 500 GiB according to the Minimum Virtual Machine Requirements.
   Data disk volume will be used for spooling, size it according to estimated log volume and max downtime.
4. Under the Advanced tab, paste the contents of cloud-init.yaml in the Custom datafield.

All other settings such authentication, network configuration and monitoring should be configured according to company policy and best practices.

Validate Collector Status

1. Click Telemetry and select Collectors from the main menu

2. Select the relevant Collector from the presented list

3. View Status

After you provision a Collector VM and start it, it will go through a process of installing updates and modules specified in the configuration ISO file which you downloaded. The time taken for this process is dependent on factors like the speed of the hardware you are running the Collector on and connectivity to the repositories that it downloads updates from. In some cases this process can take around 30 minutes.

The Collector may show as “Offline” during the initial provisioning steps. This is not any cause for alarm.

If you have any problems, please submit a ticket via the Samurai MDR portal.

Collector Status Notifications

Samurai will send email notifications to registered application users should your Local Collector status change from Healthy to Not-Healthy or Unavailable. Once any issues have been resolved, you will also be notified again when a Healthy status is reached.

If your Local Collector be restarted, during final startup you may notice the Status change from Healthy to Not-Healthy, this is not cause for alarm as this typically occurs for a short period of time as processes restart. Once complete your Local Collector status will be displayed as Healthy.

What’s next?

You should now have a collector running within your environment!

The next step is to start configuring integrations which will allow the Samurai platform to start receiving your telemetry data.

Select Integrations Overview for more information on integrations and where to start.

If you require high availability for your collector, this can be achieved using the capabilities of your virtualization platform.

Deleting a Collector

If you delete a local collector it cannot be reversed! In addition, all of your integrations related to the local collector will also be deleted!

If you need to delete a local collector you can do so by following the steps below:

1. From your Samurai MDR portal click Telemetry and select Collectors
2. Select the relevant collector from your list
3. On the right hand side of the relevant collector, click on (more options) and select Delete Collector
4. The following warning will appear: ‘Warning: This is a destructive action and cannot be reversed.’. To ensure you intended to delete the collector you will need to type DELETE in the field and select Delete Collector

Replacing a Collector

If for some reason a Local Collector VM is lost due to corruption or damage, such as in the case of a major disk storage failure, you may need to replace your Collector. If this happens, you will need to delete the old Collector in the Samurai MDR portal, discard your old Collector VM image and then create a new Collector using the process described to Install a Collector.

Important Notes:

• If you need to replace a Collector VM, you cannot re-download the installer ISO for an existing Collector and redeploy it. You must delete the old Collector and replace it with a new one.
• You can re-use the same IP address as your old Collector. This allows you to replace a Collector without re-configuring any log sources which were sending logs to the old Collector.
• When replacing a Collector, any Integrations which were automatically detected and attached to the original Collector will be automatically detected and attached to the new Collector.
• Once you have created the new Collector, you will need to add any Integrations which you were previously using and which you had to previously manually add to the old Collector.

2 - Samurai Cloud Native Collector

The Cloud Native Collector is used to ingest data from public cloud storage. The Collector itself is agnostic to the data sent to cloud storage and monitors for new or updated files and pulls the data to the Samurai platform for ingestion - therefore there are minimum cloud storage retention requirements.

We recommend a minimum cloud storage retention period of 7 days

The Cloud Native Collector is used for specific integrations and is typically a requirement for Samurai to ingest events from Microsoft Azure, Amazon Web Services and third parties that leverage cloud storage. This will be clearly indicated within the Product Integration Guide.

If you have determined that you require a Cloud Native Collector then follow the steps below to configure and create the collector from the Samurai MDR portal and ensure it is working as expected.

Create Cloud Native Collector

1. From your Samurai MDR portal tenant, click Telemetry and select Collectors from the main menu

2. Select Create Collector

3. Select Cloud collector

4. Complete the fields as required.

5. Select Create Collector

6. Based on your Provider selection a Deploy to <Provider> will be displayed

7. Select Deploy to <Provider> - this will launch a template you should follow based on your Provider.

8. Click Close and follow the relevant section below based on your Provider.

The deployment button will only be displayed once after selecting Create Collector, therefore be sure to click the button before closing the dialog window.

Microsoft Azure

Selecting Microsoft Azure will launch an Azure Resource Manager (ARM) template. Follow the steps.

1. Complete the necessary fields within the template:

Project Details

Instance Details

2. Select Next

3. Select Review and Create

4. You are now complete and can navigate to the Samurai MDR portal.

Validate Collector Status

1. Select Collectors from the left-hand menu

2. Select the relevant Collector from the presented list

3. View Status

What’s next?

You should now have a collector running!

The next step is to start configuring integrations which will allow the Samurai platform to collect your telemetry data.

Select Integrations Overview for more information on integrations and where to start.

Deleting a Collector

If you delete a Cloud collector it cannot be reversed! In addition, all of your integrations related to the local collector will also be deleted!

If you need to delete a Cloud collector you can do so by following the steps below:

1. From your Samurai MDR portal click Telemetry and select Collectors from the main menu
2. Select the relevant collector from your list
3. On the right hand side of the relevant collector, click on (more options) and select Delete Collector
4. The following warning will appear: ‘Warning: This is a destructive action and cannot be reversed.’. To ensure you intended to delete the collector you will need to type DELETE in the window and select Delete Collector