CCE Installation on Azure

Introduction

Seceon aiSIEM, the only real-time threat detection and reporting platform is built on micro-services/container architecture. This allows versatility in terms of deployment choices, whether it is installed on a bare metal Hardware Server, on a Virtual Machine or on a public Cloud like Amazon AWS and Microsoft Azure. The performance of the OTM is neither influenced nor compromised based on the deployment option chosen, rather it is critical that the computing memory and disk performance that meets the Seceon OTM Hardware specification is available.

The application runs smoothly on Azure as long as the hardware requirements are met and the installation and configuration are done properly as described in subsequent sections of this document

Installation Pre-requisites

To get the OTM deployed on the Azure cloud, a customer needs:

Server setup package (Seceon-server-setup-5.0.0-tar.gz)
CCE package

All the above tar packages can be downloaded prior to the installation process using the dropbox links provided later in this article.

Microsoft Azure Cloud Platform

Microsoft Azure (formerly Windows Azure) is a cloud computing service created by Microsoft for building, testing, deploying, and managing applications and services through a global network of Microsoft-managed data centres. It provides software as a service (SaaS), platform as a service (PaaS) and infrastructure as a service (IaaS) and supports many different programming languages, tools and frameworks, including both Microsoft-specific and third-party software and systems.

Seceon aiSIEM, being a containerized platform is compatible with a variety of installation environments. It has been commercially deployed and is running successfully on physical servers, AWS instances and Virtual machines (VMs) on ESXi servers, KVMs etc. For Azure also, a VM has to be created and then used for the aiSIEM Installation

Installation Process For aiSIEM on an Azure VM

Step1: Login to your Microsoft Azure Dashboard:

Step 2: Create VM

Go to the list on the right side of the dashboard and select “Virtual Machines”

On the “Virtual Machines” screen, select “+Add” option

Fill in the details as asked in the “Create virtual machine” form, using the information:

PROJECT DETAILS

Your existing Microsoft Azure subscription

a. Resource group to be used for creating the VM, from your existing subscription. You can also create a new resource group.

INSTANCE DETAILS

Virtual machine name: Based on your choice.
Region: Your Azure region.
Availability Option: Optional
Image: Select “CentOS based 7.5”
Size: Choose 4vCPUs, 4 GB RAM. The disk will be 30GB by default, we will increase it to our requirement in Section

Step 3: Change Disk Size

ADMINISTRATOR ACCOUNT

Authentication Type
Username
SSH Public Key
Setup your SSH login account.

Keep the rest of the settings default and create the VM. Once created, pick up the assigned IP, and login to that with the Administrator account created through ssh.

Step 3: Change Disk Size

Login to the created VM as administrator (root).
Change the disk size using instructions as below:
Check the root partition using the command “df –h”

Filesystem      Size           Used    Avail Use%  Mounted on

/dev/sda2        30G           1.2G   29G     5%       /

devtmpfs         14G           0      14G     0%       /dev

tmpfs            14G           0      14G     0%       /dev/shm

tmpfs            14G           9.0M   14G     1%       /run

tmpfs            14G           0      14G     0%       /sys/fs/cgroup

/dev/sda1        497M          81M    417M   17%      /boot

/dev/sdb1        197G          61M     187G   1%       /mnt/resource

tmpfs            2.8G           0      2.8G   0%       /run/user/1000

Here root is mounted as /dev/sda2

Go to Azure Portal, go to VM -> Disk -> Select OSDisk -> Configuration and increase OS Disk Size to 200GB.
Start up the VM
Use FDISK to delete the older partition and recreate it. Subsequent commands to be used are listed below:

 sudo fdisk /dev/sda
· u
Command (m for help): u

Changing display/entry units to cylinders (DEPRECATED!).

· p - (print) – take note of Start of /dev/sda2 (eg. 64

Command (m for help): p

Disk /dev/sda: 214.7 GB, 214748364800 bytes, 419430400 sectors

Units = cylinders of 16065 * 512 = 8225280 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk label type: dos

Disk identifier: 0x000ecbd2

Device Boot          Start         End      Blocks   Id  System

/dev/sda1   *           1          64      512000   83  Linux

/dev/sda2              64        3917    30944256   83  Linux

· d - (delete) – delete the required partition

Command (m for help): d

Partition number (1,2, default 2): 2

Partition 2 is deleted
· n - (create new partition) – recreate the deleted partition 

. p - select primary partition

Command (m for help): n

Partition type:

   p   primary (1 primary, 0 extended, 3 free)

   e   extended

Select (default p): p

Partition number (2-4, default 2): 2

First cylinder (64-26108, default 64):

Using default value 64

Last cylinder, +cylinders or +size{K,M,G} (64-26108, default 26108):

Using default value 26108

Partition 2 of type Linux and of size 199.5 GiB is set
Press w to, write the changes

Command (m for help): w

The partition table has been altered!
[seceon@cce-test ~]$ sudo reboot 
  (reboot the system)

[seceon@cce-test ~]$ sudo xfs_growfs /dev/sda2 
  (resize the partition to cover the full disk)
[seceon@cce-test ~]$ sudo xfs_growfs /dev/sda2
meta-data=/dev/sda2              isize=512    agcount=4, agsize=1934016 blks

         =                       sectsz=512   attr=2, projid32bit=1

         =                       crc=1        finobt=0 spinodes=0

data     =                       bsize=4096   blocks=7736064, imaxpct=25

         =                       sunit=0      swidth=0 blks

naming   =version 2              bsize=4096   ascii-ci=0 ftype=1

log      =internal               bsize=4096   blocks=3777, version=2

         =                       sectsz=512   sunit=0 blks, lazy-count=1

realtime =none                   extsz=4096   blocks=0, rtextents=0

data blocks changed from 7736064 to 52299871

Verify size has increased by using df -h:

[seceon@cce-test ~]$ df -h

Filesystem      Size  Used Avail Use% Mounted on

/dev/sda2       200G  1.2G  199G   1% /

devtmpfs         14G     0   14G   0% /dev

tmpfs            14G     0   14G   0% /dev/shm

tmpfs            14G  9.0M   14G   1% /run

tmpfs            14G     0   14G   0% /sys/fs/cgroup

/dev/sda1       497M   81M  417M  17% /boot

/dev/sdb1       197G   61M  187G   1% /mnt/resource

tmpfs           2.8G     0  2.8G   0% /run/user/1000

Step 4: Setup Seceon env

Login to the VM as administrator
Run the command “sudo -i”, to get into root mode.
Download the server setup package using the command given below:

Untar the server setup package using the command:

Get inside the folder, and run the setup script:

Wait for the setup to get installed.
Then, reboot the VM using “reboot” command.

Step 5: Install CCE:

Login to the VM as seceon/seceon.
Download the CCE package using the command given below:

Match the md5sum of the package using the command given below:

You should see the output:

If you don’t see this output, your download is not correct. Please download again.

Run the command:

Download the “cce-global-config.yml” and “install.sh files”, as given below:

1.cce-gobal-config.yml:

Install.sh

Change the privilege of the install script using the command: chmod 775 install.sh
Run the commands:

Answer the questions:

Do APE & CCE coexist?

In an Enterprise, CCE and APE may co-exist; but in MSSP Enterprise, they are unlikely to coexist.

If you press Yes, it will ask for confirmation else it will prompt you for The Tenant Id: In case of Enterprise you can just press enter else Type in the Tenant ID given by the MSSP.

APE IP address:

Do you want secure communication between CCE & APE using Ssh Tunnel?

This will be Yes only if APE is not on VPN and has a public IP and there is no VPN tunnel between APE &CCE.

SSH Tunnel Port: 22 (Default)