Local Collector
What is the Local Collector?
The SamurAI Local Collector is a deployable component that enables the collection and secure transfer of telemetry data from client-controlled environments to the SamurAI Platform.
It is used when a local ingestion point is required to collect and forward telemetry from systems that are not directly integrated with the platform.
Multiple Local Collectors can be deployed by a client as necessary to support scaling, segmentation of data sources, or architectural requirements.
What does the Local Collector do?
The Local Collector performs the following functions:
- Receives telemetry from systems within the client environment
- Processes and forwards data to the SamurAI Platform
- Supports multiple ingestion methods, such as syslog and log forwarding mechanisms
- Securely transmits data to the SamurAI Platform
- Buffers data locally during temporary connectivity interruptions
The Local Collector integrates with the broader SamurAI telemetry ingestion architecture, alongside cloud-based and API-driven collection methods.
How does the Local Collector work?
The Local Collector operates as an intermediary between source systems and the SamurAI Platform.
- Telemetry is generated by systems within the client environment
- Data is forwarded to the Local Collector
- The Local Collector receives and prepares the data for ingestion
- Data is securely transmitted to the SamurAI Platform
- The platform processes and analyzes the telemetry
Depending on the integration type, the Local Collector supports both push and pull data collection models.
Where can the Local Collector be deployed?
The Local Collector can be deployed within environments, including:
- On-premises virtual infrastructure (for example VMware vSphere or Microsoft Hyper‑V)
- Cloud-hosted virtual machines (for example Amazon EC2 or Microsoft Azure)
- NTT Smart Data Platform (SDPF)
This flexibility allows the Local Collector to be positioned close to telemetry sources while maintaining secure connectivity to the SamurAI Platform.
What data sources are supported?
The Local Collector can ingest telemetry from a range of systems, including:
- Network infrastructure (for example firewalls and proxies)
- Servers and operating systems
- Identity and authentication systems
- Security tools that generate log-based telemetry
Telemetry is typically forwarded using syslog or supported log forwarding methods.
What is the data flow?
The Local Collector participates in the SamurAI ingestion pipeline as follows:
- Receives telemetry from source systems
- Forwards data securely to the SamurAI Platform
- Data is ingested, normalized, and processed for detection and response
When should the Local Collector be used?
The Local Collector is typically used when:
- Telemetry originates from internal or client-controlled environments
- Systems cannot be integrated directly using API-based methods
- A local ingestion point is required due to network or architectural constraints
Who is responsible for the Local Collector?
The client is responsible for the deployment, installation, and configuration of the Local Collector, including the underlying infrastructure (for example virtual machine, storage, networking, and cloud-hosted environments such as Amazon EC2 or Microsoft Azure).
The client is also responsible for configuring data sources to forward telemetry to the Local Collector and ensuring ongoing connectivity between the Local Collector and the SamurAI Platform.
The SamurAI team is responsible for providing and maintaining the Local Collector software and ensuring its integration with the SamurAI Platform.
The SamurAI platform monitors the health and availability of the Local Collector and will notify registered users if any issues are detected. Once issues are resolved, a notification will confirm the return to a healthy state.
If the SamurAI team identifies that a Local Collector is undersized or under heavy load, we will liaise with the client to determine the appropriate next steps, which may include adjustments to allocated resources or deployment architecture.
What’s Next?
Review the requirements to determine what is needed before deployment and configuration of a Local Collector.
1 - Requirements
What you need to get started
- Access to the SamurAI Portal and your specific tenant.
- A supported deployment platform for the Local Collector. Supported hypervisors and cloud platforms are listed below.
- A virtual machine that meets the minimum virtual machine requirements.
- The required network changes to meet the Collector connectivity requirements.
- A static IP address for the Collector and DNS server IP addresses, unless you use DHCP.
- Access to the products where you need to make the changes described in the relevant integration guide.
Supported hypervisors
| Hypervisor | Supported version or requirement |
|---|
| VMware ESXi | ESXi 8.x and ESXi 9.x |
| Microsoft Hyper-V | Hyper-V 2016 and later; deploy the Local Collector as a Generation 2 virtual machine. |
| Proxmox Virtual Environment | Proxmox VE 8.4.1 and later. |
| KVM-based environments | KVM environments that support UEFI virtual machines and can import the Local Collector KVM bundle. |
The SamurAI Local Collector is delivered as a UEFI-based virtual appliance.
For KVM-based environments, configure the virtual machine with UEFI firmware before deployment. The required method for creating, importing, and configuring a KVM virtual machine varies by KVM management platform.
| Platform | Supported instance types or requirements |
|---|
| Amazon EC2 | Nitro-based instances using HVM virtualization. |
| Azure Virtual Machine | Ubuntu Server virtual machines that meet the minimum requirements. |
| NTT Smart Data Platform (SDPF) | Ubuntu Server instances that meet the minimum requirements. |
Minimum virtual machine requirements
The following virtual machine requirements support up to 15K events per second (EPS) peak, 10K EPS sustained over a 24-hour period, and approximately 800 GB of data per day.
| Resource | Requirement |
|---|
| CPU | 2 vCPU |
| Disk | 500 GB dedicated data disk for spooling, in addition to the operating-system disk. |
| Memory | 4 GB RAM |
The data disk is used for log spooling. Size the disk according to estimated log volume and the maximum expected period of Collector or network unavailability.
Connectivity required for the Collector
The Collector requires connectivity to the resources listed below. Update security controls, such as firewall rules, proxy settings, and DNS configuration, as needed to allow the required communications.
| Function | Protocol | Port | Source | Destination | Details |
|---|
| Enrolment, Telemetry | TCP | 443 | Collector | *.*.security.ntt
nttsecurity.io .nttsecurity.io .*.nttsecurity.io
samurai-xdr-prod-westeurope-xgliuoit.azure-api.net | All regular backend communication, telemetry |
| Remote Management | TCP | 443 | Collector | ra.cto.nttsecurity.io
deb.releases.teleport.dev
apt.releases.teleport.dev | Used for remote administration of Collector (this is not mandatory and used when troubleshooting) |
| NTP | UDP | 123 | Collector | Client infrastructure (NTP server(s)) if configured in SamurAI Portal
OR
0.ubuntu.pool.ntp.org
1.ubuntu.pool.ntp.org
2.ubuntu.pool.ntp.org
3.ubuntu.pool.ntp.org | Time synchronization |
| DNS | UDP | 53 | Collector | Client infrastructure (DNS server(s)) or external DNS servers (based on your Collector configuration) | Domain name resolution |
| Ubuntu updates | TCP | 80, 443 | Collector | *.ubuntu.com
api.snapcraft.io | Ubuntu software repository |
| Container Management | TCP | 443 | Collector | docker.com
*.docker.com (private container registry)
docker.io (private container registry)
*.docker.io (private container registry) | Private container registry |
| Amazon Cloud dependencies | TCP | 443 | Collector | *.cloudfront.net | Amazon CDN used by Collector API |
| Log storage | TCP | 443 | Collector | *.s3.*.amazonaws.com | Amazon Cloud storage (this is not mandatory and used when troubleshooting) |
| Telemetry data | (based on product - see Integration guide) | Client Product | Collector | Frequent data transfer (based on product) | |
What’s next?
You now understand the supported deployment platforms, minimum virtual machine requirements, and required connectivity. Proceed to Deployment.
2 - Deployment
The need for a Local Collector depends on the product being integrated with the SamurAI platform. This is indicated in the relevant Product Integration Guide.
- Log in to the SamurAI Portal, select Telemetry, and then select Collectors from the main menu.
- Select Create Collector.
- Select Local Collector.
- Complete the fields as required.
| Field | Description |
|---|
| Collector name | A nickname for the Collector. |
| Description (Optional) | A description of the Collector, such as the property name where it is installed. |
| Location (Optional) | Useful when you have Collectors in multiple locations. |
| Hostname | A hostname for the Collector. |
| Proxy Server IP (Optional) | An optional HTTP proxy URL containing a hostname or IP address and port, for example https://192.168.1.254:8080. |
| NTP Servers (Optional) | Your NTP server IP addresses. |
| DHCP or Static | Select DHCP, or specify a static IP address and network information. |
- Select Create Collector.
- Select the Collector by clicking the name provided in step 4.
- Select Download.
The files you download depend on the deployment platform.
Configuration
- ISO — Collector-specific configuration file.
- Required for all virtual-machine deployments. Mount this ISO when the Collector starts for the first time so that it can configure and register with the SamurAI platform.
Cloud init
- AWS — Cloud-init data for an AWS instance.
- Azure — Cloud-init data for an Azure virtual machine.
- SDPF — Cloud-init data for an NTT Smart Data Platform (SDPF) instance.
Virtual machine
- OVA — Virtual appliance package for VMware vSphere and Proxmox VE.
- Includes the virtual disk image and virtual-machine configuration.
- VMDK — Virtual disk image for VMware vSphere.
- For manual deployment; it requires manual virtual-machine configuration.
- VHDX — Virtual hard-disk image for Microsoft Hyper-V.
- KVM bundle — Virtual-machine package for KVM-based environments.
- The bundle contains the files required to deploy the Local Collector on a KVM platform.
All Local Collector virtual-machine images are configured for UEFI firmware. Configure the virtual machine to use UEFI firmware before deployment.
- Download the Collector configuration ISO file and the file required for your selected deployment platform.
If you are creating multiple Collectors, you only need to download the OVA or KVM bundle once for the same Local Collector release. Download a unique configuration ISO file for each Collector.
Manual deployment using VMDK files is not part of the standard deployment process. Before deploying a VMDK file, configure the virtual machine with
UEFI firmware and apply the
Minimum Virtual Machine Requirements.
Install a Collector
Select the section relevant to your deployment platform:
VMware vSphere
Follow the VMware documentation:
- When prompted for a virtual-machine name, use a meaningful name, for example
samurai-nttsh-collector. - Select the Local Collector OVA file downloaded from the SamurAI Portal.
- Ensure the virtual machine is configured to use UEFI firmware.
- Configure CPU, memory, storage, and networking in accordance with the Minimum Virtual Machine Requirements.
After deployment, configure the virtual machine to use the Local Collector configuration ISO file. Refer to VMware documentation:
- Select the Collector configuration ISO file downloaded from the SamurAI Portal when prompted to select an ISO file.
- Ensure that the CD/DVD drive is connected when the virtual machine starts.
- Power on the virtual machine.
The configuration ISO file must be mounted at first boot to configure and register the Collector. After the Collector status is
Healthy in the SamurAI Portal, dismount or remove the ISO file.
Microsoft Hyper-V
Follow Microsoft documentation:
- When prompted for a virtual-machine name, use a meaningful name, for example
samurai-nttsh-collector. - Configure the virtual machine to use UEFI firmware.
- Configure memory and networking in accordance with the Minimum Virtual Machine Requirements.
- When prompted to connect a virtual hard disk, select the VHDX file downloaded from the SamurAI Portal.
- Attach the Collector configuration ISO file to the virtual DVD drive and ensure that the drive is connected at startup.
- Start the virtual machine.
The configuration ISO file must be mounted at first boot to configure and register the Collector. After the Collector status is
Healthy in the SamurAI Portal, dismount or remove the ISO file.
Proxmox Virtual Environment
Follow the Proxmox documentation:
- Create or select storage to use as the import source.
- Use the OVA/OVF import workflow to import the Local Collector OVA file downloaded from the SamurAI Portal.
- Ensure that the imported virtual machine is configured to use UEFI firmware.
- Configure CPU, memory, storage, and networking in accordance with the Minimum Virtual Machine Requirements.
Import the Local Collector configuration ISO file to Proxmox:
- Navigate to Datacenter and select Storage.
- Select the storage location where you want to store the ISO file.
- Select ISO Images.

- Select Upload.
- Select the Local Collector configuration ISO file and upload it using the default settings.

Configure the Local Collector virtual machine to use the configuration ISO file:
- Select the Local Collector virtual machine, select Hardware, and then select Add.

- Select CD/DVD Drive.

- Select Use CD/DVD disk image file (ISO), locate the Local Collector configuration ISO file, and then select Add.

- Confirm that the network interface is available as Network Device (net0).
- Start the virtual machine.
The configuration ISO file must be mounted at first boot to configure and register the Collector. After the Collector status is
Healthy in the SamurAI Portal, dismount or remove the ISO file.
KVM-based environments
This section applies to KVM environments, including platforms that use libvirt, QEMU/KVM, or another KVM management interface. Because KVM implementations and management interfaces differ, follow the documentation provided by your KVM platform for the virtual-machine creation and import workflow.
Prerequisites:
- Download the Collector configuration ISO file for the Collector you created.
- Download the Local Collector KVM bundle from the SamurAI Portal.
- Extract the KVM bundle.
Use your KVM platform documentation to create or import a virtual machine using the extracted Local Collector image.
When creating or configuring the Local Collector virtual machine:
- Configure the virtual machine to use UEFI firmware.
- Configure CPU, memory, storage, and networking in accordance with the Minimum Virtual Machine Requirements.
- Attach the Local Collector configuration ISO file as a virtual CD/DVD drive.
- Ensure the virtual CD/DVD drive is connected when the virtual machine starts for the first time.
- Start the virtual machine.
For guidance on KVM virtual-machine configuration, refer to the documentation for your management platform. Examples include:
The configuration ISO file must be mounted at first boot to configure and register the Collector. After the Collector status is
Healthy in the SamurAI Portal, dismount or remove the ISO file.
The Local Collector KVM image requires UEFI firmware. Ensure that UEFI firmware support is installed and enabled in your KVM environment before starting the virtual machine.
Amazon EC2
Prerequisite steps:
- Download the AWS
cloud-init.yaml file from Create, configure and download a Collector. You will use this file during EC2 instance deployment.
Follow Amazon documentation to launch an EC2 instance:
Apply the following adjustments while following the Amazon documentation:
- Select Ubuntu as the AMI.
- Select the latest supported Ubuntu AMI.
- Select an instance type that meets the Minimum Virtual Machine Requirements.
- Configure the key pair and network settings according to your organisation’s policies. Ensure network settings fulfil the Connectivity required for the Collector.
- In Configure storage:
The secondary disk volume is used for spooling. Size it according to estimated log volume and maximum expected downtime.
- In Advanced details, paste the contents of the AWS
cloud-init.yaml file into User data. Do not select User data has already been base64 encoded. - Complete the remaining instance configuration according to your organisation’s requirements and the Amazon documentation.
Azure Virtual Machine
Prerequisite steps:
- Download the Azure
cloud-init.yaml file from Create, configure and download a Collector. You will use this file during Azure virtual-machine deployment.
Follow Microsoft documentation to create an Azure virtual machine:
Apply the following adjustments while following the Microsoft documentation:
- Under the Basics tab, select Ubuntu Server 22.04 LTS as the image.
- Under the Basics tab, select a suitable size that meets the Minimum Virtual Machine Requirements.
- Under the Disks tab, add one data disk of at least 500 GiB, sized in accordance with the Minimum Virtual Machine Requirements.
The data disk is used for spooling. Size it according to estimated log volume and maximum expected downtime.
- Under the Advanced tab, paste the contents of
cloud-init.yaml into the Custom data field.
Configure all other settings, including authentication, networking, and monitoring, according to your organisation’s policy and best practices.
NTT Smart Data Platform (SDPF) is currently available only in the Japan region.
Prerequisite steps:
- Download the SDPF
cloud-init.yaml file from Create, configure and download a Collector. You will use this file during instance creation.
Follow NTT documentation to create a server instance:
Apply the following adjustments while following the NTT documentation:
- When selecting the image, select the latest Ubuntu 24.04 official image.
- When selecting compute series and size, select a suitable specification that meets the Minimum Virtual Machine Requirements.
- Add a separate data disk of at least 500 GB, sized in accordance with the Minimum Virtual Machine Requirements.
Add a separate data disk instead of expanding the root disk. The data disk is used for spooling. Size it according to estimated log volume and maximum expected downtime.
- When selecting the logical network, ensure that it fulfils the Connectivity required for the Collector. This typically requires an Internet Gateway, logical network, subnet, and potentially firewall rules that allow the Collector’s required outbound connectivity.
- In the Post-install script field, select Direct Input and paste the contents of the
cloud-init.yaml file.
Configure all other settings, including authentication, networking, and monitoring, according to your organisation’s policy and best practices.
Deleting a Collector
Deleting a Local Collector cannot be reversed. All integrations related to that Local Collector are also deleted.
To delete a Local Collector:
- In the SamurAI Portal, select Telemetry and then Collectors.
- Select the relevant Collector.
- On the right side of the relevant Collector, select More Options (
) and then select Delete Collector. - Review the warning. To confirm the destructive action, enter
DELETE and select Delete Collector.
Replacing a Collector
If a Local Collector virtual machine is lost because of corruption or damage, such as a major storage failure, delete the existing Collector in the SamurAI Portal, discard the old virtual-machine image, and create a new Collector by following the installation process.
- To replace a Local Collector VM, you cannot download the installer ISO for an existing Collector and redeploy it. Delete the old Collector and create a replacement Collector.
- You can reuse the same IP address as the old Collector. This allows replacement without reconfiguring log sources that sent logs to the original Collector.
- Integrations that were automatically detected and attached to the original Collector are automatically detected and attached to the replacement Collector.
- Add again any integrations that were manually added to the original Collector.
What’s next?
You have now deployed and configured your Local Collector.
Refer to Local Collector Details for information about validating Collector status and additional configuration.
3 - Local Collector Details
Validate Collector Status
Click Telemetry and select Collectors from the main menu
Select the relevant Collector from the presented list
View Status
| Indicator | Status | Description |
|---|
| Pending | Collector components installing / provisioning or awaiting status |
| Unknown | The SamurAI platform is unable to determine a status |
| OK | Healthy |
| Warning | Warning status will be displayed if the Collector is experiencing any issues e.g components are experiencing problems |
| Critical | Critical status will be displayed and an email notification will be sent to registered users (by default) if the SamurAI platform cannot communicate with the Collector |
After you provision a Collector VM and start it, it will go through a process of installing updates and modules specified in the configuration ISO file which you downloaded. The time taken for this process is dependent on factors like the speed of the hardware you are running the Collector on and connectivity to the repositories that it downloads updates from. In some cases this process can take around 30 minutes.
If you have any problems, please submit a ticket via the SamurAI Portal.
If your Local Collector is being provisioned or has been restarted, the Collector may cycle through multiple status updates, this is not cause for alarm as this typically occurs for a short period of time as processes restart. Once complete your Local Collector status will be displayed as OK.
Collector Email Notifications
By default email notifications are enabled. The SamurAI platform sends email notifications to registered users when a Collector is reported as Critical (e.g. the SamurAI platform cannot communicate to the Collector) however this is customizable by users for any Collector status.
SamurAI Portal users can opt in or out of email notifications for any status. Please review
Notifications Settings.
Enable or Disable Email Notifications
- Click on More Options (
) to the right of the table - Select Notifications
- Toggle the setting to enable or disable by selecting the bell icon. Alternatively you can select the default setting
- Click Save
You can also achieve this per individual Collector by:
- Click on More Options (
) to the left of the Collector - Select Notifications
- Toggle the setting to enable or disable by selecting the bell icon. Alternatively you can select the default setting (send notification).
- Click Save
If your Local Collector is being proivisioned or has been restarted, the Collector may cycle through multiple status updates, this is not cause for alarm as this typically occurs for a short period of time as processes restart. Once complete your Local Collector status will be displayed as OK.
What’s next?
The next step is to start configuring integrations which will allow the SamurAI platform to start receiving your telemetry data.
Select Integrations Overview for more information on integrations and where to start.
If you require high availability for your collector, this can be achieved using the capabilities of your virtualization platform.