Install Sensors

You can install a sensor on a physical appliance or virtual machine, with the following requirements:

Note the following about designated Mirror interfaces:

• Mirror interfaces receive a copy of all inbound and outbound source traffic to the destination. Ensure that your peak traffic is less than the capacity of the sensor's Mirror interface link.
• Many switches drop packets from the source interfaces if a mirror port destination is configured with too much traffic.

If your sensor is deployed as a virtual machine, ensure that the virtual host and network are configured for promiscuous mode on the second network interface if you plan to ingest traffic from a mirror or SPAN port.

Warning: When deploying the sensor in a VMWare 8 environment, the sensor will fail to load when using the default UEFI boot setting. To fix this issue, on the Customize Hardware step, select VM Options > Boot Options, then choose BIOS from the Firmware drop-down list.

VMware hypervisor

If you are running the virtual machine on a VMware hypervisor, configure the virtual switch for promiscuous mode:

1. Select the host in the inventory.

2. Select the Configuration tab.

3. Click Networking.

4. Click Properties for your virtual switch.

5. Select the virtual switch and click Edit.

6. Select the Security tab.

7. Select Accept from the Promiscuous Mode drop-down.

See the VMware knowledge base for more information on promiscuous mode. You may need to set the VLAN ID to 4095.

VirtualBox

If you are running the virtual machine in VirtualBox, configure the adapter for promiscuous mode:

1. Select the adapter for the Mirror interface from the Network Settings.

2. Set promiscuous mode to Allow in the Advanced Options.

See the VirtualBox documentation on virtual networking for more information.

If you are deploying a sensor to a physical appliance, you deploy an .iso file which installs the sensor, based on Ubuntu Linux.

If you write the .iso file to an optical disc, such as a CD or DVD, you can reboot the physical appliance with the optical disc in an optical disc drive, and choose to boot from the optical disc.

If you create a USB flash drive with the .iso file and the Rufus utility, you can reboot the physical appliance, insert the USB flash drive into a USB port, and choose to boot from the USB flash drive.

Note: If you deploy a sensor without using an ISO, you may need to update the local appliance's firewall settings to allow traffic. We highly recommend that you deploy the sensor using the provided ISO.

Warning: Creating a bootable USB flash drive deletes all information on the flash drive. Ensure that the flash drive does not have any other information on it.

Download the latest version of the sensor ISO from Cisco XDR. Use this either to install (for a new sensor) or reinstall (to upgrade an existing sensor).

1. Log in to Cisco XDR as an administrator.

2. Choose Administration > On-Premises Appliances in the navigation menu and click the Sensors tab.

3. Click the Installation tab.

4. Click the .iso button to download the latest ISO version.

5. Go to Create a Bootable Optical Disc or Create a Bootable USB Flash Drive.

Create a Bootable Optical Disc

Follow your manufacturer's instructions to copy the .iso file to an optical disc.

Create a Bootable USB Flash Drive

1. Insert a blank USB flash drive into a USB port on the appliance you want to use to create the bootable USB flash drive.

2. Log in to the workstation.

3. In your web browser, go to the Rufus utility website.

4. Download the latest version of the Rufus utility.
5. Open the Rufus utility.
6. Select the USB flash drive in the Device drop-down.
7. Choose Disk or ISO image from the Boot selection drop-down list.
8. Click SELECT and select the sensor ISO file.

9. Click START.

Warning: Creating a bootable USB flash drive deletes all information on the flash drive. Ensure that the flash drive does not have any other information on it.

1. Choose the boot method for the .iso as follows:

   • Virtual Machine: If you are installing on a virtual machine, boot from the .iso file.

   • Physical Appliance: If you are installing on a physical appliance, insert the bootable media, restart the appliance, and boot from the bootable media.

2. Select Install ONA (Static IP) at the initial prompt, then press Enter.

   

3. Select a language from the language list using the arrow keys, then press Enter.

   

4. For the Keyboard configuration, you have the following options:

   • Select a Layout and Variant to configure the keyboard, then press Enter.

   • Select Identify keyboard, then press Enter.

     

5. For the Network configuration, select Manual and press Enter.

   

   Note: All other network interfaces are automatically configured as Mirror interfaces.

6. Enter a Subnet for the appliance, select Continue with the arrow keys, and press Enter.

7. Enter an IP address for the appliance, select Continue with the arrow keys, and press Enter.

8. Enter a Gateway router IP address, select Continue with the arrow keys, and press Enter.

9. (Optional) For Search domains, enter the domain(s) that will be automatically appended to the hostname when attempting to resolve to an IP address, select Continue with the arrow keys, and press Enter.

   Note: By default, the install will automatically use DHCP and proceed with the install. To override the DHCP IP address, you will need to manually edit the interface after the install is complete.

   Note: We recommend that you enter a local authoritative name server address if you have one deployed in your network.

   

10. Enter the Full name for the new user, which is associated with a non-root account for administrative permissions, then select Continue with the arrow keys and press Enter.

11. Enter Your servers name, which is the name the sensor will use when communicating with other computers and will be visible in Cisco XDR, then select Continue with the arrow keys and press Enter.

12. Enter the Username for your account, which is the non-root account with administrative permissions, then select Continue with the arrow keys and press Enter.

13. Choose a password for the new user, then select Continue with the arrow keys and press Enter.

14. Re-enter password to verify, then select Continue with the arrow keys and press Enter.

    If you did not enter the same password twice, try again.

    Note: The account you create during setup is the only account you can use to access the virtual machine. This installation does not create a separate Cisco XDR account.

    

15. To confirm the installation process, select Continue, then press Enter.

    Warning: This action deletes all data on the drive. Ensure it is empty before proceeding.

    

    Wait several minutes for the installer to install the required files.

16. When the installer displays Installation Complete, select Reboot Now with the arrow keys, then press Enter to restart the appliance.

    

17. After the appliance restarts, log in with the created account to ensure your credentials are correct.

• If restricting access to your private environments, make sure that communication with the relevant IPs is allowed. See Sensor Access Requirements for more information.

• If you are using the sensor to collect network flow traffic, such as NetFlow, see Configure a Sensor to Collect Flow Data for more information on configuring the sensor.

• If you are using the sensor and attaching it to SPAN or mirror ports to collect mirrored traffic, see Sensors for more information on adding sensors in Cisco XDR.

To install the sensor on Ubuntu with NetFlow collection, complete the following steps:

Warning: Make sure that you enter the complete command for each step.

1. Log in to the Ubuntu system as an administrator and open a command line interface.
2. Enter sudo wget https://assets-production.obsrvbl.com/ona-packages/obsrvbl-ona/v5.1.3/ona-service_UbuntuNoble_amd64.deb to download the ONA package.
3. Enter sudo apt-get install -y net-tools tcpdump to install dependencies.
4. Enter sudo apt-get update && sudo apt-get install -y libglib2.0-0 liblzo2-2 libltdl7 to install updates and additional packages.
5. Enter sudo wget https://assets-production.obsrvbl.com/ona-packages/netsa/v0.1.27/netsa-pkg.deb to download the package manager file.
6. Enter sudo apt install ./ona-service_UbuntuNoble_amd64.deb ./netsa-pkg.deb to install the package manager file.
7. Enter sudo reboot to reboot Linux.
8. Confirm services are running. See Appendix C - Services for Cisco XDR services.

To install the sensor on Ubuntu without NetFlow collection, complete the following steps:

Warning: Make sure that you enter the complete command for each step.

1. Log in to the Ubuntu system as an administrator and open the command line interface.
2. Enter wget https://assets-production.obsrvbl.com/ona-packages/obsrvbl-ona/v5.1.3/ona-service_UbuntuNoble_amd64.deb to download the ONA package.
3. Enter sudo apt-get install -y net-tools tcpdump to install dependencies.
4. Enter sudo apt-get -f install to verify dependencies installed properly.
5. Enter sudo apt install ./ona-service_UbuntuNoble_amd64.deb to install the service.
6. Confirm services are running. See Services for a list of Linux services.

To install the sensor on Docker, complete the following steps:

Warning: Make sure that you enter the complete command for each step.

1. Log in to the Docker system as an administrator and open the command line interface.

2. Checkout the ONA service repository on GitHub.

3. Enter the following command to build the container from the ONA directory:

   Copy

   docker build \
     --platform linux/amd64 \
     --tag obsrvbl/ona-service:latest \
     images/docker

4. Enter the following example command to update the service key and run it:
   

   Copy

   docker run \
       --platform linux/amd64 \
       --name=ona-service \
       --net=host \
       --cap-add=NET_ADMIN \
       --rm \
       --tty \
       --interactive \
       -e OBSRVBL_HOST="https://sensor.ext.obsrvbl.com" \
       -e OBSRVBL_SERVICE_KEY="the_service_key" \
       -e OBSRVBL_ONA_NAME="ona-sensor-$(whoami)" \
       -e OBSRVBL_PNA_IFACES='your_interfaces' \
       obsrvbl/ona-service:latest 

   • To find your OBSRVBL_HOST url, in Cisco XDR, go to Administration > Custom Detections > Sensors.

   • To find your OBSRVBL_SERVICE_KEY, see the first 3 steps of Manually Add Cisco XDR's Service Key to a Sensor.

   • OBSRVBL_ONA_NAME is the name of your sensor.

   • OBSRVBL_PNA_IFACES is a list of your interfaces.

   Note: The --net=host and --cap-add=NET_ADMIN flags are required for the ONA-service to be able to monitor the host's network interfaces and generate flow data.

Verify the Sensor

To verify the status of the sensor, complete the following steps:

1. Enter the following command to log in to the container from a separate terminal window:

   docker exec -it ona-service bash

2. Enter the following commands to check the logs for errors:

   ls -l /opt/obsrvbl-ona/logs/ona_service/

   tail -f /opt/obsrvbl-ona/logs/ona_service/*

3. Ensure the following files exist and do not contain any errors or exceptions in the log directory:

   • ona-hostname-resolver.log

   • ona-pdns-monitor.log

   • ona-pdns-pusher.log

   • ona-pna-pusher.log

   • ona-service.log

4. Confirm services are running. See Services for Cisco XDR services.

Cisco XDR utilizes the following Linux services:

The following private network monitoring Linux directories and file paths contain advanced sensor configuration.

• /opt/obsrvbl-ona – This directory contains the Cisco XDR configuration files (config, config.auto, config.local) and various sub-directories created during the sensor installation, including log file directories.

• /opt/obsrvbl-ona/config – This text file, created during the sensor installation, contains default sensor configuration. Cisco recommends that this file is not directly edited, changes should be made in config.local. If you want to edit this file, create a backup first. You can reference this file when updating the config.local file. Configuration settings in the config.local file overrides the default config file configuration.

  Information: The most recent version of the config configuration file is located on the Cisco XDR GitHub site at https://github.com/obsrvbl-oss/ona/blob/master/packaging/root/opt/obsrvbl-ona/config.

• /opt/obsrvbl-ona/config.auto – This text file contains sensor configuration changes users make from the web portal. For example, if you enable a sensor’s logging to syslog or SNMP from the web portal, the web portal updates this file to include these configuration updates. We recommend that you do NOT edit this file directly.

• /opt/obsrvbl-ona/config.local – This text file contains custom configuration for this sensor. Configuration updates to this file override configuration settings in the config configuration file. Examples of local configuration include, but are not limited to, enabling flow collection, setting flow collection types (for example, NetFlow v5, IPFIX, etc.), and enabling third-party integrations.

• /opt/obsrvbl-ona/logs/PNA – This directory contains log files related to flows created by the sensor’s Ethernet ports. The sensor periodically uploads these files to the cloud, and empties the directory after it does so. You can monitor this directory to ensure that a mirror port is working properly, as the log files increment in byte count and quantity, relative to the size of the data entering the Ethernet ports.

  In the following image, the log files are very small, indicating very little Ethernet port traffic. However, the service is running, and actively generating log files.

  

• /opt/obsrvbl-ona/logs/ipfix – This directory contains log files collected by the flow data feeds, such as NetFlow and IPFIX. If this directory exists, then flow collection is properly enabled and being received. If this directory does not exist, flow collection is probably not enabled.

  In the following image, the log files are not incrementing and are empty. The sensor is not receiving flow data.

  

• /etc/iptables – This directory contains the iptables firewall configuration files for the sensor.