Install a vLC on Microsoft Hyper-V Manager
You can install an Arctic Wolf® Virtual Log Collector (vLC) in a Microsoft Hyper-V® environment.
Note:
- Each virtual appliance virtual machine (VM) supports one network interface. If more network interfaces are necessary, deploy more virtual appliance VMs.
- If you are deploying multiple virtual appliance instances, Arctic Wolf recommends that you use the same OVA file, and then complete the installation and activation process again for each virtual appliance.
- Cloning a virtual appliance instance is not supported because it creates operational errors in the original virtual appliance and in the cloned instance.
Note: During connectivity tests, appliances may communicate with external IP addresses behind a cloud service that Arctic Wolf hosts.
These resources are required:
- These system resources:
- 2 vCPUs
- 8 GB RAM
- 40 GB storage
Note: Reducing or limiting resource allocations below the specified requirements affects virtual appliance performance. If the appliance's CPU is throttled, security observations can be lost. Do not configure the Reservation, Limit, or Shares settings to throttle the appliance's CPU. - Microsoft Hyper-V Server 2016 or newer
These actions are required:
- Make sure you have the appropriate Arctic Wolf permissions to install the appliance. Contact your Concierge Security® Team (CST) at security@arcticwolf.com to identify who in your organization has these permissions.
- Add all necessary IP addresses, ports, and services to your allowlist for full appliance functionality.
Tip: To see the IP addresses that you must allowlist, sign in to the Arctic Wolf Unified Portal, click , and then view the IP addresses in the section for your product.
- If you rate-limit the appliance with Quality of Service (QoS), remove this for best performance.
- If your firewall provides SSL/TLS inspection, do not do this inspection on the appliance management IP address.
- If you use an application proxy or layer 7 filter on your firewall, allow outbound traffic for the appliance management IP address.
- Optional: Configure two vLCs in a high availability environment. For more information, see Configure high availability for two on-premise vLCs.
- Configure log forwarding. For more information, see Syslog forwarding.
Download the vLC image
Deploy the vLC
Connect to the serial console
- If the virtual appliance power is off, right-click your VM in the Hyper-V Manager, and then select Start.
- In the Hyper-V Manager, double-click the VM to bring up the console.
Configure the vLC
Use the serial console to configure the vLC. For more information on using the serial console, see Serial console.
Activate the vLC
Note: Only the user who configured the vLC can activate the vLC.