Deployment

The need for a Cloud Collector is based on the specific product being integrated with the SamurAI platform. This will be clearly indicated within the Product Integration Guide.

Create a Cloud Collector

1. From the SamurAI Portal, click Telemetry and select Collectors from the main menu

2. Select Create Collector

3. Select Cloud collector

4. Complete the fields as required.

5. Select Create Collector

6. Follow the relevant section below based on your provider:

• Microsoft Azure
• Amazon Web Services (AWS)
• Splunk HTTP Event Collector

Microsoft Azure

1. Click Deploy to Azure and you will be redirected to the Microsoft Azure login.

2. An Azure Resource Manager (ARM) template will be launched, follow the steps and complete the necessary fields within the template:

Project Details

Instance Details

3. Select Next

4. Select Review and Create

5. Upon creation your Collector status will be updated to Healthy.

6. You can now refer to the relevant Product Integration Guides.

Amazon Web Services (AWS)

1. Click Launch Stack and you will be redirected to the AWS login.

2. Login to your AWS account with administrative permissions.

3. The SamurAI cloud formation template will be displayed.

4. If you have an existing S3 Bucket enter the name within the Parameters section under Enable SamurAI ingestion on existing S3 bucket. If you have no existing S3 bucket, leave this field blank and a new S3 bucket will be created.

5. If you are integrating Cisco Umbrella, be sure to update Cisco Umbrella under the Parameters section to Yes.

6. Click Create Stack.

7. Upon creation of the stack your Collector status will be updated to Healthy.

8. You can now refer to the relevant Product Integration Guides.

Additional required steps when using an existing bucket

1. Add the following to the bucket policy, please update the json with the correct bucket name.

 {
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::600502389717:user/samurai-xdr-s3-reader-user"
    },
    "Action": [
        "s3:GetObject",
        "s3:ListBucket"
    ],
    "Resource": [
        "arn:aws:s3:::BUCKET_NAME",
        "arn:aws:s3:::BUCKET_NAME/*"
    ]
}

2. Create an Event Notification in the bucket properties.

3. Enter an Event Name for the notification, leave the Prefix and Suffix boxes blank.

4. Select All object create events

5. Under Destination, select SNS Topic and select the SNS topic that was created by the Cloud Formation Template from the drop down and click Save Changes.

Splunk HTTP Event Collector

1. If you selected this option you will be presented with the following information:

• API URL
• Token

Copy these entries as you will need them when completing your integration.

2. Select Close.

Deleting a Collector

If you need to delete a Cloud collector you can do so by following the steps below:

1. From your SamurAI Portal click Telemetry and select Collectors from the main menu
2. Select the relevant collector from your list
3. On the right hand side of the relevant collector, click on More Options () and select Delete Collector
4. The following warning will appear: ‘Warning: This is a destructive action and cannot be reversed.’. To ensure you intended to delete the collector you will need to type DELETE in the window and select Delete Collector

What’s next?

You should now have a Cloud Collector running.

Refer to Cloud Collector Details for information on validating Collector Status and details.