Install a vSensor using VMware vSphere

The Arctic Wolf® Virtual Sensor (vSensor) is a virtual appliance that performs passive network inspection and collects security-relevant data for analysis. Arctic Wolf Managed Detection and Response (MDR) uses one or more sensor deployments to monitor events in your network and identify potential threats.

Each vSensor virtual machine (VM) supports one network interface. If you need additional network interfaces, you must deploy additional vSensor VMs.

If you are deploying multiple vSensor instances, we recommend reusing the OVA file. However, you must repeat the installation and activation process for each vSensor.

Cloning a vSensor instance is not supported, because this method introduces operational errors in both the original vSensor and the cloned instance.

Requirements

• vSphere with vCenter 6.5 or newer

• The appropriate Arctic Wolf permissions to complete the virtual scanner deployment. Contact your Concierge Security® Team (CST) to confirm who in your organization has these permissions.

• The appropriate Arctic Wolf permissions to complete the virtual scanner deployment. Contact your Concierge Security® Team (CST) to confirm who in your organization has these permissions.

• The following resources requirements:

  Note: Reducing or limiting resource allocations below the specified requirements impacts vSensor performance.

  Model	Number of vCPUs	RAM	Storage
  AWNv100	2	8 GB	40 GB
  AWNv200	8	16 GB	40 GB
  AWNv1000	24	48 GB	40 GB

Before you begin

• Make sure you have the appropriate Arctic Wolf permissions to complete the vSensor deployment. Contact your Concierge Security Team© (CST) to confirm who in your organization has these permissions.
• Add all necessary IP addresses, ports, and services to your allowlist for full vSensor functionality.

  Tip: To see the complete list of IP addresses that you must allowlist, go to the Arctic Wolf Unified Portal, and then click Help > Allowlist Requirements. The IP addresses that must be allowlisted are listed under Sensors.

• If you rate-limit the vSensor with Quality of Service (QoS), remove this for best performance.
• If your firewall provides SSL/TLS inspection, do not perform this inspection on the vSensor management IP address.
• If you are using an application proxy or layer 7 filter on your firewall, allow outbound traffic over OpenVPN for the vSensor management IP address.

Steps

1. Download the vSensor image.
2. Deploy the vSensor.
3. Verify that the vSensor deployed correctly.
4. Configure the vSensor.
5. Activate the vSensor.

Step 1: Download the vSensor image

1. Sign in to the Arctic Wolf Portal.
2. Click Account > Downloads.
3. In the Virtual Network Appliances section, click Download Virtual Network Appliance to start the OVA file download.

   Tip: If your browser downloads the OVA file in .ovf format, rename the file to change the file extension to .ova.

Step 2: Deploy the vSensor

1. Sign in to your vSphere client.

2. Right-click your resource pool, and then click Deploy OVF Template.

3. On the Select an OVF template page:

   1. Select Local file.
   2. Click UPLOAD FILES.
   3. Select the downloaded OVA file, and then click Open.
   4. Click Next.

4. On the Select a name and folder page:

   1. In the Virtual machine name field, enter a name for the vSensor.
   2. Select the location for the virtual machine, and then click Next.
   3. Click Next.

5. On the Select a compute resource page:

   1. Select a destination compute resource.
   2. Click Next.

6. On the Review details page, click Next.

7. On the Configuration page, select one of the following:

   • AWNv100 Virtual Sensor
   • AWNv200 Virtual Sensor
   • AWNv1000 Virtual Sensor

   Note: You can view your available vSensor models in the Arctic Wolf Portal under Arctic Wolf Appliance Management.

8. On the Select storage page:

   1. (Optional) Select Encrypt this virtual machine. See the VMware vSphere product documentation for steps to encrypt an existing virtual machine or virtual disk.

      Tip: While optional, Arctic Wolf strongly recommends that you encrypt the vSensor to ensure that all data stored and flowing through the appliance has an additional layer of protection.

   2. Select the storage location for the configuration and disk files, and then click Next.

9. On the Select networks page:

   1. Select the appropriate Destination Network.

      Log traffic is sent to the vSensor over this network.

   2. Click Next.

10. On the Ready to complete page, click Finish.

    Note: The OVA image may take some time to upload. In the vSphere Client, you can check the progress of the upload on the Recent Tasks tab.

Step 3: Verify that the vSensor deployed correctly

1. If the vSensor power is off, right-click your virtual machine in the vSphere Client, and then click Power > Power On.
2. Check if the vSensor VM power is on.
3. Verify that the VM IP address is reported in the VM summary.

Step 4: Configure the vSensor

1. In the vSphere web UI, right-click your virtual machine, and then click Power > Power On.

2. Right-click your virtual machine, and then click Console > Open Console.

3. When prompted, press Enter three times to initiate the serial console session.

4. At the Select an option to configure your management interface with prompt, select DHCP or enter a static IP address for the vSensor management interface.

   Note: If you select DHCP, you must use a DHCP reservation to prevent log collection and connection errors.

5. Click Next.

6. At the Use a proxy? prompt, do one of these actions:

   • If your vSensor traffic needs to go through a proxy server, select Yes, and then configure these fields:
     • Server IP address — Enter the proxy server IP address for your appliance.
     • Server port — Enter the proxy server port.
   • If your vSensor traffic does not need to go through a proxy server, select No.

7. Click Next.

8. At the Do you want to verify your network connection? prompt, select one of these options:

   • Yes

     A series of connectivity tests run.

   • No

9. Click Next.

10. At the Tell us about the application you are configuring prompt, configure these settings:

    1. In the Shorthand field, enter the shorthand name for the vSensor.

    2. Select Mirroring.

11. Click Next.

12. When prompted, do one of these actions to connect the vSensor to the Arctic Wolf Platform:

    • Using a mobile device — Scan the QR code displayed in the console window, and then follow the on-screen prompts.
    • Using a web browser — Enter the displayed URL into a web browser, and then follow the on-screen prompts.

    Note: QR codes expire after 15 minutes. A new code appears in the console if the QR code expires.

    After the vSensor successfully connects to the Arctic Wolf Platform, a prompt replaces the QR code, asking you to go to the Arctic Wolf Appliance Management.

Step 5: Activate the vSensor

1. In the Arctic Wolf Portal, click Account > Arctic Wolf Appliance Management.

2. Locate the name or the serial number of the vSensor you want to activate.

3. In the Actions column, click Activate virtual appliance, and then click Activate Virtual Network Appliance when prompted.

   The console displays Appliance activation in progress, please wait.

4. When prompted, press Enter three times to activate the console.

Configure vSensor in a mirroring deployment

To configure vSensor in a mirroring deployment, follow the instructions to create a port mirroring session in the VMware documentation.

Optional layer 3 mirroring configuration

Reconfigure a vSensor using VMware vSphere

1. In the vSphere web UI, right-click your virtual machine, and then click Console > Open Console.
2. When prompted, press Enter three times to initiate the serial console session.
3. Change the required settings.

Uninstall a vSensor using VMware vSphere

1. Decommission the vSensor:

   1. Sign in to the Arctic Wolf Portal.

   2. Click Account > Arctic Wolf Appliance Management

      A list of deployed virtual appliances appear on the Arctic Wolf Appliance Management page.

   3. Locate the short name or serial number of the vSensor that you want to decommission.

   4. Under Actions, click Decommission Virtual Appliance, and then select Decommission Virtual Appliance when prompted.

2. Turn off the vSensor VM power.
3. In the vSphere Client, select the vSensor, and then click Delete from Disk.

See also

• Serial Console User Guide