What you need to get started
- Access to the SamurAI Portal and your specific tenant.
- A supported deployment platform for the NTA. Supported hypervisors and cloud platforms are listed below.
- An NTA virtual machine that meets the recommended specifications for the required monitoring throughput.
- Network changes required to meet the NTA communication requirements.
- A static IP address for the NTA management interface and DNS server IP addresses, unless you use DHCP.
- Access to configure traffic mirroring to the NTA monitoring interface.
The NTA requires two network interfaces: one management interface for secure outbound communication with the SamurAI platform, and one monitoring interface for mirrored network traffic. Only one monitoring interface is currently supported.
Supported hypervisors
| Hypervisor | Supported version or requirement |
|---|---|
| VMware ESXi | ESXi 8.x and ESXi 9.x |
| Microsoft Hyper-V | Hyper-V 2016 and later; deploy the NTA as a Generation 2 virtual machine. |
| Proxmox Virtual Environment | Proxmox VE 8.4.1 and later. |
| KVM-based environments | KVM environments that support UEFI virtual machines, provide two virtual network interfaces, and can import the NTA KVM bundle. |
The NTA is delivered as a UEFI-based virtual appliance.
For KVM-based environments, configure the virtual machine with UEFI firmware before deployment. The method for creating, importing, and configuring a virtual machine varies by KVM management platform.
Supported cloud platforms
| Platform | Supported instance types or requirements |
|---|---|
| Amazon EC2 | Nitro-based instances using HVM virtualization and supporting VPC Traffic Mirroring. |
Amazon Web Services support
For AWS deployment, the NTA requires AWS Nitro instances that support traffic mirroring. For more information, refer to:
Recommended specifications
NTA sizing is based on the expected monitored network throughput. Select the NTA size that meets your required throughput.
| Medium | Large | |
|---|---|---|
| Throughput | 500 Mbit/s | 1000 Mbits/s |
| CPU | 8 Cores | 8 cores |
| Memory | 52 GB RAM (32 GB RAM for OS and 20GB RAM for ramdisk) | 104 GB RAM (64 GB RAM for OS and 40GB RAM for ramdisk) |
| Disks | System disk: 300GB Data disk 200GB | System disk: 300GB Data disk 200GB |
| Network Interfaces | Management:1 x 1 Gbit/s Network Monitoring:1 x 1 Gbit/s | Management:1 x 1 Gbit/s Network Monitoring:1 x 1 Gbit/s |
A typical 1 Gbit/s network interface operates in full-duplex mode: up to 1 Gbit/s transmit and 1 Gbit/s receive, or up to 2 Gbit/s aggregate throughput. Consider this when sizing the NTA and configuring traffic mirroring.
Communication requirements
The NTA requires connectivity to the resources listed below. Update security controls, such as firewall rules, proxy settings, and DNS configuration, as needed to allow the required communications.
| Function | Protocol | Port | Source | Destination | Details |
|---|---|---|---|---|---|
| Enrolment, NTA backend | TCP | 443 | NTA | *.*.security.ntt nttsecurity.io .nttsecurity.io .*.nttsecurity.io samurai-xdr-prod-westeurope-xgliuoit.azure-api.net | All regular backend communication |
| Remote Management | TCP | 443 | NTA | ra.cto.nttsecurity.io deb.releases.teleport.dev apt.releases.teleport.dev | Remote administration of an NTA |
| NTP | UDP | 123 | NTA | Client infrastructure (NTP server(s)) if configured in SamurAI Portal OR 0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org | Time synchronization |
| DNS | UDP | 53 | NTA | Client infrastructure (DNS server(s)) or external DNS servers (based on your NTA configuration) | Domain name resolution |
| Ubuntu updates | TCP | 80, 443 | NTA | *.ubuntu.com api.snapcraft.io | Ubuntu software repository |
| Container Management | TCP | 443 | NTA | docker.com *.docker.com (private container registry) docker.io (private container registry) *.docker.io (private container registry) | Private container registry |
| Amazon Cloud dependencies | TCP | 443 | NTA | *.cloudfront.net | Amazon CDN used by NTA API |
What’s next?
You now understand the supported deployment platforms, NTA sizing requirements, and required communications. Proceed to SamurAI NTA Deployment.