Install a vLC on Microsoft Hyper-V Manager

You can install an Arctic Wolf® Virtual Log Collector (vLC) in a Microsoft Hyper-V® environment.

Note:
  • Each virtual appliance virtual machine (VM) supports one network interface. If more network interfaces are necessary, deploy more virtual appliance VMs.
  • If you are deploying multiple virtual appliance instances, Arctic Wolf recommends that you use the same OVA file, and then complete the installation and activation process again for each virtual appliance.
  • Cloning a virtual appliance instance is not supported because it creates operational errors in the original virtual appliance and in the cloned instance.
Note: During connectivity tests, appliances may communicate with external IP addresses behind a cloud service that Arctic Wolf hosts.

These resources are required:

  • These system resources:
    • 2 vCPUs
    • 8 GB RAM
    • 40 GB storage
    Note: Reducing or limiting resource allocations below the specified requirements affects virtual appliance performance. If the appliance's CPU is throttled, security observations can be lost. Do not configure the Reservation, Limit, or Shares settings to throttle the appliance's CPU.
  • Microsoft Hyper-V Server 2016 or newer

These actions are required:

  • Make sure you have the appropriate Arctic Wolf permissions to install the appliance. Contact your Concierge Security® Team (CST) at security@arcticwolf.com to identify who in your organization has these permissions.
  • Add all necessary IP addresses, ports, and services to your allowlist for full appliance functionality.
    Tip: To see the IP addresses that you must allowlist, sign in to the Arctic Wolf Unified Portal, click Resources > Allowlist Requirements, and then view the IP addresses in the section for your product.
  • If you rate-limit the appliance with Quality of Service (QoS), remove this for best performance.
  • If your firewall provides SSL/TLS inspection, do not do this inspection on the appliance management IP address.
  • If you use an application proxy or layer 7 filter on your firewall, allow outbound traffic for the appliance management IP address.

Download the vLC image

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Resources > Downloads.
  3. In the Virtual Network Appliances section, click the Hyper-V tab.
  4. In the Version list, select Hyper-V awnv100.
  5. Click Download.
    Tip:

    If your browser downloads the OVA file in .ovf format, rename the file to change the file extension to .ova.

Deploy the vLC

  1. Sign in to your Hyper-V Manager.
  2. Extract the zip file that you downloaded.
  3. Right-click the server, and then click Import Virtual Machine.
  4. Click Next.
  5. In the Locate Folder section:
    1. Click Browse.
    2. Navigate to the extracted zip file location.
      Note: Import the entire VM from the template, not just the virtual hard disk. This template already includes settings for CPUs, RAM, and network adapters that align with the vLC requirements.
    3. Click Select Folder.
    4. Click Next.
  6. In the Select Virtual Machine section:
    1. Confirm that this is the correct VM.
    2. Click Next.
  7. On the Choose Important Type screen:
    1. Select Copy the virtual machine (create a new unique ID).
    2. Click Next.
  8. Optional: In the Choose Destination section, store the VM in a different location:
    Tip: We recommend that you add the virtual machine name to the end of the path to allow for multiple virtual appliances in the future.
    1. Select Store the virtual machine in a different location.
    2. Update the paths to the location where you want to store the image.
  9. Click Next.
  10. Optional: In the Choose Storage Folders section, change the location to store the imported virtual hard disk.
    Tip: We recommend that you add the virtual machine name to the end of the path to allow for multiple virtual appliances in the future.
  11. Click Next.
  12. In the Summary section, click Finish to import the VM.
  13. Connect the network interfaces:
    1. Right-click on the VM that you created and then click Settings.
    2. Click the network interface that you want to connect the vLC to.
    3. Under Virtual switch, select the network to connect the vLC to.
      Note: Use an existing network in your environment. You do not need to create a new one.
    4. Click Apply.
    5. Click OK.
  14. Optional: Update the configuration version:
    1. Right-click the VM that you created, and then click Upgrade Configuration Version.
      Note: If the VM is already on the most recent version for that system, this option does not appear.
    2. In the confirmation dialog, click Update.

Connect to the serial console

  1. If the virtual appliance power is off, right-click your VM in the Hyper-V Manager, and then select Start.
  2. In the Hyper-V Manager, double-click the VM to bring up the console.

Configure the vLC

Use the serial console to configure the vLC. For more information on using the serial console, see Serial console.

  1. When prompted, press Enter three times to initiate the serial console session.
  2. At the Select an option to configure your management interface with prompt, select DHCP or enter a static IP address for the virtual appliance management interface.
    Note: If you select DHCP, you must use a DHCP reservation to prevent log collection and connection errors.
  3. Select Next.
  4. At the Use a proxy? prompt, do one of these actions:
    Note: Only management interface traffic over OpenVPN is sent to the proxy server.
    • If your virtual appliance management traffic goes through a proxy server, select Yes, and then configure these settings:
      • Server IP address — Enter the proxy server IP address for your appliance.
      • Server port — Enter the proxy server port.
    • If your virtual appliance management traffic does not go through a proxy server, select No.
  5. Select Next.
  6. At the Do you want to verify your network connection? prompt, select one of these options:
    • Yes

      A series of connectivity tests run. If a connectivity check fails, edit your network settings as needed, and then complete the connectivity checks again.

    • No
  7. Select Next.
  8. At the Tell us about the application you are configuring prompt, configure these settings:
    1. In the Shorthand field, enter a shorthand name for the virtual appliance.
    2. Select VLC.
  9. Select Next.
  10. When prompted, do one of these actions to connect the virtual appliance to Arctic Wolf:
    Note: Make sure you have the appropriate Arctic Wolf permissions to install the vLC. You can view the permissions in the Contacts page of the Unified Portal or contact your Concierge Security® Team (CST) at security@arcticwolf.com to identify who in your organization has these permissions.
    • On a mobile device — Scan the QR code displayed in the console window, and then follow the on-screen prompts.
      Note: QR codes expire after 15 minutes. A new code appears in the console if the QR code expires.
    • In a web browser — Enter the displayed URL into the URL field, and then follow the on-screen prompts.

    After the virtual appliance successfully connects to Arctic Wolf, a prompt replaces the QR code.

Activate the vLC

Note: Only the user who configured the vLC can activate the vLC.
  1. Sign in to the Arctic Wolf Unified Portal.
  2. If you are a Managed Service Provider (MSP), verify that you are viewing the correct customer organization.
  3. In the navigation menu, click Data Collection > Sensors.
  4. Find the virtual appliance that you want to activate, and then click View Sensor.
    Tip: Virtual appliances that are not activated have the Awaiting Activation status.
  5. Click Activate.
    The console displays Appliance activation in progress, please wait.
  6. If you are an MSP, select the same customer organization that you are currently viewing in the Unified Portal, and then Activate Virtual Appliance.
    Note: To activate the virtual appliance for a different customer, switch to that customer organization before completing this step.
    The serial console displays Appliance activation in progress, please wait.
  7. In the serial console, when prompted, press Enter three times to activate the console.