Requirements
What you need to get started
- Access to the SamurAI Portal and your specific tenant.
- A supported deployment platform for the Local Collector. Supported hypervisors and cloud platforms are listed below.
- A virtual machine that meets the minimum virtual machine requirements.
- The required network changes to meet the Collector connectivity requirements.
- A static IP address for the Collector and DNS server IP addresses, unless you use DHCP.
- Access to the products where you need to make the changes described in the relevant integration guide.
Supported hypervisors
| Hypervisor | Supported version or requirement |
|---|---|
| VMware ESXi | ESXi 8.x and ESXi 9.x |
| Microsoft Hyper-V | Hyper-V 2016 and later; deploy the Local Collector as a Generation 2 virtual machine. |
| Proxmox Virtual Environment | Proxmox VE 8.4.1 and later. |
| KVM-based environments | KVM environments that support UEFI virtual machines and can import the Local Collector KVM bundle. |
The SamurAI Local Collector is delivered as a UEFI-based virtual appliance.
For KVM-based environments, configure the virtual machine with UEFI firmware before deployment. The required method for creating, importing, and configuring a KVM virtual machine varies by KVM management platform.
Supported cloud platforms
| Platform | Supported instance types or requirements |
|---|---|
| Amazon EC2 | Nitro-based instances using HVM virtualization. |
| Azure Virtual Machine | Ubuntu Server virtual machines that meet the minimum requirements. |
| NTT Smart Data Platform (SDPF) | Ubuntu Server instances that meet the minimum requirements. |
Minimum virtual machine requirements
The following virtual machine requirements support up to 15K events per second (EPS) peak, 10K EPS sustained over a 24-hour period, and approximately 800 GB of data per day.
| Resource | Requirement |
|---|---|
| CPU | 2 vCPU |
| Disk | 500 GB dedicated data disk for spooling, in addition to the operating-system disk. |
| Memory | 4 GB RAM |
The data disk is used for log spooling. Size the disk according to estimated log volume and the maximum expected period of Collector or network unavailability.
Connectivity required for the Collector
The Collector requires connectivity to the resources listed below. Update security controls, such as firewall rules, proxy settings, and DNS configuration, as needed to allow the required communications.
| Function | Protocol | Port | Source | Destination | Details |
|---|---|---|---|---|---|
| Enrolment, Telemetry | TCP | 443 | Collector | *.*.security.ntt nttsecurity.io .nttsecurity.io .*.nttsecurity.io samurai-xdr-prod-westeurope-xgliuoit.azure-api.net | All regular backend communication, telemetry |
| Remote Management | TCP | 443 | Collector | ra.cto.nttsecurity.io deb.releases.teleport.dev apt.releases.teleport.dev | Used for remote administration of Collector (this is not mandatory and used when troubleshooting) |
| NTP | UDP | 123 | Collector | Client infrastructure (NTP server(s)) if configured in SamurAI Portal OR 0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org | Time synchronization |
| DNS | UDP | 53 | Collector | Client infrastructure (DNS server(s)) or external DNS servers (based on your Collector configuration) | Domain name resolution |
| Ubuntu updates | TCP | 80, 443 | Collector | *.ubuntu.com api.snapcraft.io | Ubuntu software repository |
| Container Management | TCP | 443 | Collector | docker.com *.docker.com (private container registry) docker.io (private container registry) *.docker.io (private container registry) | Private container registry |
| Amazon Cloud dependencies | TCP | 443 | Collector | *.cloudfront.net | Amazon CDN used by Collector API |
| Log storage | TCP | 443 | Collector | *.s3.*.amazonaws.com | Amazon Cloud storage (this is not mandatory and used when troubleshooting) |
| Telemetry data | (based on product - see Integration guide) | Client Product | Collector | Frequent data transfer (based on product) |
What’s next?
You now understand the supported deployment platforms, minimum virtual machine requirements, and required connectivity. Proceed to Deployment.