VMware NSX Network Detection and Response System Administration Operations

This document describes the system administration of VMware NSX Network Detection and Response appliances mostly focused on an On-Premises installation.

About Appliances

The VMware NSX Network Detection and Response deploys a three-tier architecture. It provides a monitoring tier with the Sensor, an analysis tier provided by the Engine and Data Node, and a management tier where the Manager coordinates activity and connections across the installation. In an On-Premises installation, you install all three tiers in your data center. For the Hosted environment, you only install the monitoring tier, with the VMware backend providing the analysis and management tiers, accessed through your account on the User Portal at https://user.lastline.com/ (for EMEA customers https://user.emea.lastline.com/).

Manager

The Manager collects information from Sensor appliances, processes the data, and finally presents it to the user. Artifacts (such as executables and documents) that are attached to email messages or provided in URLs are passed to the Engine for immediate analysis. Data is also shared with the Data Node.

The Manager provides a local instance of the User Portal, a comprehensive Web interface. You use its dashboards and other pages to view the activity detected within your environment and manage the VMware NSX Network Detection and Response appliances.

See the Manager Installation and Administration guide for installation and initial configuration details.

Sensor

The Sensor performs active or passive inspection of your network traffic to identify events that are of interest to the system. This ranges from file transfers (for example, executables, documents, or email messages) to metadata on network activities observed in the environment (for example, netflow, pdns, or webrequests). The information extracted by the Sensor is streamed to the VMware backend for processing.

See the Sensor Installation and Administration guide for installation and initial configuration details.

The Sensor can also be deployed to AWS and Azure cloud environments. See the Sensor on AWS Deployment and Administration and Sensor on Azure Deployment and Administration guides for details.

Engine

The Engine simulates an entire host (including the CPU, system memory, and all peripherals) and its operating environment to analyze unknown files, such as executables and documents, and URLs. These data are submitted from the Manager and other sources. The Engine then runs the artifacts and returns the results of its analysis to the Manager.

See the Engine Installation and Administration guide for installation and initial configuration details.

Data Node

The Data Node receives data records (such as netflow, passive DNS, and webrequest records) collected by the Sensor as well as from third party solutions, such as network switches and routers, security devices, and dedicated netflow probes. It stores these data and analyzes them. It then returns analysis results to the Manager.

See the Data Node Installation and Administration guide for installation and initial configuration details.

Before you begin

Before you can successfully deploy the VMware NSX Network Detection and Response in your data center, there are a number of requirements that must be met. Your network infrastructure must allow the default connections needed by the VMware appliances. You must determine the optimal placement of the Sensor appliances to gain the greatest visibility into the traffic entering and leaving your network. Finally, you must determine which system features you wish to enable and license your installation accordingly.

Connectivity requirements

In an On-Premises installation, the Manager must be able to access the VMware backend to obtain threat intelligence, software, and license updates. In addition, the VMware backend optionally (dependent on your license and system settings) returns cloud analysis results from suspicious samples you uploaded and supports on-demand queries to the Knowledge Base and other data sources. The VMware backend facilitates other essential services to ensure your installation is running correctly to provide maximum protection.

The Sensor in the Hosted environment must also be able to access the VMware backend.

Note:

In the event of disconnection, the Sensor, in either a Hosted or On-Premises environment, will continue to work autonomously using its current threat intelligence data. Detected events are stored locally. When connectivity is re-established, the data is uploaded with the correct timestamp.

Domain name services

The VMware NSX Network Detection and Response appliances require access to domain name servers (DNS) that can resolve external names, including the VMware backend as well as internal names.

External domain names

The Manager must be able to access:

  • user.lastline.com on TCP/443 (in Europe user.emea.lastline.com).

  • update.lastline.com on TCP/443 (in Europe update.emea.lastline.com).

  • ntp.lastline.com on UDP/123 for time synchronization (in Europe ntp.emea.lastline.com). It can be replaced with a local NTP server. Access to an NTP server is required for the correct operation of the system.

  • log.lastline.com on TCP/443 (in Europe log.emea.lastline.com).

  • anonvpn.lastline.com on UDP/1194.

External IP addresses

The domain names above currently resolve to IP addresses within the following CIDR blocks:

  • 38.95.226.0/24

  • 38.142.33.16/28

  • 199.91.71.80/28

  • 46.244.5.64/28

  • 66.170.109.0/24

Adjust your firewall rules to allow connections to these address ranges.

Internal domain names

The system appliances, the Sensor, the Engine, and the Data Node depend on the Manager to provide the VMware backend services. You should assign a local domain name to the Manager. Assuming your organization has the example.com domain and that lastline.example.com is the FQDN of the Manager, the following domain names should be additional aliases for the same IP address:

  • user.lastline.example.com

  • update.lastline.example.com

  • log.lastline.example.com

CDN usage

To increase availability and reduce download times, the VMware NSX Network Detection and Response installation can be configured to download large files from content distribution network (CDN) servers. As such hosts are geographically distributed, the contacted hosts may vary from system to system. CDN servers outside the documented list of IP addresses may be contacted for downloads.

The use of CDNs is enabled by default during installation or upgrade. You can also explicitly enable or disable this feature with the lastline_register command.

If you explicitly enable the use of CDNs or choose to accept the default, ensure that you adjust your firewall rules to allow access to the CDN servers.

Internal connections

Data Node cluster communication

The Data Node needs to access TCP port 9200 and 9300 on every other Data Node appliance in order to create an Elasticsearch cluster. TCP port 9200 is used for REST traffic and TCP port 9300 is used for Data Node communication. The Manager must also be able to communicate with the Data Node on TCP port 9200.

To obtain data records from the RabbitMQ broker running on log.lastline.example.com, access to port 5671 (encrypted channel) and port 5672 (non-encrypted channel) is required.

Local communication network

The VMware NSX Network Detection and Response appliances employ a number of Docker containers to provide services. These containers require an internal network to use for communication. By default, this network is defined to use 169.254.64.0/20, a portion of the IPv4 link-local address space. This network does not need to be reachable from outside services or hosts.

Proxy server

The Manager in an On-Premises installation or the Sensor in the Hosted environment must be able to access the VMware backend.

If a network proxy is deployed in your environment, you need the IP address or FQDN of the proxy server and its port number before you install the VMware NSX Network Detection and Response appliances. Authentication must be disabled for the appliances that utilize the proxy server. If the proxy server limits the domains that can be accessed, *.lastline.com must be allowed or, at a bare minimum, allow access to the listed FQDN.

Examples of valid proxy configurations: proxy.example.com:3128 or 192.168.0.1:8080

Note:

The VMware NSX Network Detection and Response appliances cannot communicate through Sophos Transparent or through Microsoft Forefront proxies.

Network Time (NTP)

To accurately report events, incidents, and intrusions, the VMware NSX Network Detection and Response appliances need to keep their clocks in close synchronization. By default, the installer selects ntp.lastline.com for time synchronization. During installation, or afterward with the lastline_setup command, you can replace this with another NTP server.

Important:

The selected NTP server, whether it is on your local network or an external device, must be reachable over UDP port 123. Without NTP access, the system cannot work correctly.

SSL/TLS certificate

The VMware NSX Network Detection and Response appliances provide most of their services through HTTPS. During installation, the Manager generates and then uses a self-signed SSL certificate. This requires all the managed appliances to store and trust this certificate during the registration phase.

When you access the User Portal hosted on the Manager, your browser also needs to trust the certificate.

Replace the certificate

You can optionally replace the SSL/TLS certificate on the Manager. This can be your own self-signed certificate or a certificate signed by the certificate authority (CA) for your organization. Assuming a FQDN of lastline.example.com, the certificate needs to be valid for:

  • user.lastline.example.com

  • update.lastline.example.com

  • log.lastline.example.com

Note:

If you deploy an active-standby configuration, the certificate should also be valid for user.standby.lastline.example.com

In this scenario, you should use user.lastline.example.com as the commonName for the certificate. Then specify the above domain names as Subject Alternative Name (SAN). This way user.lastline.example.com will work even for clients that do not support SAN. The certificate needs to be in x509 format. Intermediate CA certificates need to be appended to the server certificate file.

See the Deploy a New Certificate topic in the Manager Installation and Administration guide for instructions.

Email monitoring options

The VMware NSX Network Detection and Response provides a number of methods for monitoring email in your network and preventing attacks with the Sensor:

Passive
  • Sniff SMTP traffic

  • POP3/IMAP

  • MTA (no delivery)

Active
  • MTA inline

Passive monitoring

Passive email monitoring allows you to see email traffic on your network and obtain reports that can be used for further action.

You can configure the Sensor to sniff all network traffic. In this mode, it processes any SMTP packets it sees on the wire. A major limitation with this method is that any email that is encrypted at transport level (SMTP/TLS) cannot be inspected. In addition, the Sensor can only see traffic that traverses its network segment and cannot compensate for errors seen by its SPAN or TAP interface. Sensor placement location is critical. One of the few advantages of using SMTP sniffing is that it can see both inbound and outbound traffic on the network segment.

Alternatively you can configure the Sensor as an IMAP or POP3 client. This mode requires that you also configure the email flow into your organization to blind-copy all inbound messages to the designated user account on the Sensor. All messages received by this account are deleted after analysis.

The recommended mode for passive monitoring is to configure the Sensor as an MTA (no delivery) endpoint. This mode provides visibility into all email messages that are accepted by the downstream MTA server, including those sent over TLS. The connection is also reliable, using TCP retries for any network errors. This mode requires that you configure the email flow into your organization to FORK all inbound messages to the Sensor. All messages received by this account are deleted after analysis.

Active monitoring

The most highly recommended configuration is active email monitoring. As above, this also provides visibility into all email traffic on your network. In addition, it allows you to either quarantine messages with malicious content or to clean the malicious content from the messages before sending them onward to the next hop. Configure the Sensor as an MTA relay. This mode requires that the email flow into your organization is configured to add the Sensor as an MTA hop in your email processing.

Appliance placement

The VMware NSX Network Detection and Response provides the best protection when the Sensor appliances have complete visibility across your entire network. It is recommended that you deploy a Sensor on all the critical segments of your network:

  • Network borders for Internet, extranet, and VPN.

  • Core data center segments.

  • Cloud workloads (AWS VPCs or Azure Virtual Networks).

  • IOT/ICS/SCADA infrastructure.

  • End user segments.

Command line configuration tools

The VMware NSX Network Detection and Response provides a number of command line utilities to assist you with the configuration and management of the appliances.

During the installation and registration process, you use the lastline_register command. It defines the essential parameters of the appliance, including the critical network connections, then applies your licenses to the installation.

Once the appliance is registered and running, you can use the lastline_setup command to adjust certain settings. There are certain parameters that can only be changed from this command line application.

Note:

See Setup command options for a detailed breakdown of the options available with the lastline_setup command.

Enable SSH access

By default, the Manager is configured to allow key-based authentication. To use this feature, you must add your public SSH key to the lastline user account to enable future SSH access.

  1. Generate a key pair

    On your local system, use the ssh-keygen command to generate an RSA key pair.

    admin@host:~$ ssh-keygen -f ~/.ssh/llkey
    Generating public/private rsa key pair.
    Enter file in which to save the key (/home/admin/.ssh/llkey):
    Enter passphrase (empty for no passphrase):ENTER
    Enter same passphrase again:ENTER
    Your identification has been saved in /home/admin/.ssh/llkey.
    Your public key has been saved in /home/admin/.ssh/llkey.pub.
    The key fingerprint is:
    SHA256:pKhfuP8h9xlJKza7Z0R3Hq0LCrkYMGEv1A4JYOxFM admin@example.com
    The key's randomart image is:
    +---[RSA 2048]----+
    | . .E.           |
    |  + o .          |
    | . o *  .        |
    |  . +.=o   . .   |
    |   +...+S . o o  |
    |   ...= o. o = . |
    |  . ..o*+ + + +  |
    |   . o o+B.= =   |
    |    o...++B.o    |
    +----[SHA256]-----+

    The above example shows generating the key pair without a passphrase. For high security installations, a passphrase may be required.

    Note:

    On Windows systems, use PuTTYgen to generate the key pair.

  2. Import your public key

    Copy your public key onto a physical medium such as a USB device.

    admin@host:~$ cp .ssh/llkey.pub keycopy

    Then login to the console of the VMware NSX Network Detection and Response appliance using the username lastline.

  3. Append to the authorized keys list

    On the appliance, append the copy of your public key from the transfer device to the .ssh/authorized_keys file in the lastline user's home directory.

    lastline@lastline-manager:~$ cat keycopy >> ~/.ssh/authorized_keys

    Verify your public key was appended to the authorized keys list.

    lastline@lastline-manager:~$ cat ~/.ssh/authorized_keys
    ssh⁠-⁠rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNrBpwY54v4XDePpQlDOBNpQpyBuJnPY3ThAE3YPAtqlboKeiUNDDgHbYLVVdXV8CFpvShaJ1oFZj5CNjp4krD9Bx2aK3QpoRX3e3ZWSv2JxlbBs61J4fTiKnyDyeGcqx3Q2JjgRTww5AfE4c5GYZrpPTG5UkKfd6Jl8Pq1qyatHWXhCTpquOqPB1lTmS0f2gna8CMVyunV1CLVhmQVeNU2EgGQMh2wJpxO59ohNVD950HJM6lJiQVoAk7nAoJvvcHkCmrB7SSVN7xv2FIthYswVWnPU58BELwJazCu7qKcxKt0T6MdVhnZSiv64M56EBUJyXd7F3 admin@example.com

    Then log out of the appliance.

  4. SSH to the appliance

    From your local system, use the ssh command to access the VMware NSX Network Detection and Response appliance.

    admin@host:~$ ssh -i ~/.ssh/llkey lastline@manager.example.com
    Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-171-generic x86_64)
    
    Last login: Tue Apr 14 17:00:50 2020 on console
    lastline@lastline-manager:~$

An alternative remote access method to the VMware NSX Network Detection and Response appliance is to enable the monitoring user.

Configuration command

The lastline_setup command provides a number of configuration options that are used to administer and manage the VMware NSX Network Detection and Response appliances. Its basic usage is illustrated with the help option.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Run the help option

    To view all the supported options, type help.

    -> help
    Documented commands (type help <topic>):
    ========================================
    EOF                                    email_relay_port
    analysis_max_upload_filesize_mb        email_relay_username
    analysis_queue_backlog                 email_sender_address
    anonvpn_dns_server_ip                  exit
    anonvpn_mode                           failover_multicast_address
    anonvpn_upstream_gateway_ip            failover_multicast_port
    anonvpn_upstream_ifname                failover_virtual_ip
    appliance_state                        fqdn
    appliance_uuid                         ha_active_priority
    cloud_analysis                         ha_password
    cloud_analysis_push_download_metadata  heartbeats
    cloud_analysis_push_download_source    help
    cloud_analysis_query_url_reputation    https_proxy
    data_retention_code                    image_brand_replacement
    data_retention_generated_files         license_api_token
    data_retention_memory_dumps            license_key
    data_retention_process_dumps           llama_images_server_override
    data_retention_screenshots             monitoring_user_password
    data_retention_traffic_captures        network
    data_retention_uploads                 new_monitoring_user_password
    data_retention_webpages                ntp_server
    disable_report_commenting              ntp_servers
    disable_support_channel                offline_mode
    edit                                   save
    email_relay_host                       show
    email_relay_password                   text_brand_replacement
    Tip:

    For any option, type the first few unique characters of its name then type Tab. The lastline_setup command will auto-complete the name for you.

  3. View help details

    To view a detailed description of individual options, type help topic, where topic is the name of a specific option.

    -> help network
     network <variable> [<new-value>]
            Get/set network settings.
                network interface <iface>: interface used for network access
                network method dhcp|static: use DHCP or static IP address
                    configuration for network access
            When static configuration is used, these values must also be set:
                network address <address>: IPv4 address of the interface
                network netmask <netmask>: dotted-quad netmask for the address
                network gateway <gateway>: default gateway for network access; if
                    specified value is -, set gateway to None
                network dns_nameservers <nameserver> ...: space-separated list of
                    DNS nameservers, if specified value is -, set dns_nameservers to
                    None
  4. Exit the configuration tool

    To quit from the configuration tool without saving your changes, type exit.

    -> exit
    lastline@lastline-manager:~$

Enable the monitoring user

As an alternative to the lastline user, the VMware NSX Network Detection and Response offers the monitoring user. This account can access the appliances using console or via SSH (password only without using the SSH key). Once enabled, the monitoring user has the same level of system privileges as the lastline user.

To enable the monitoring user, use the new_monitoring_user_password option of the lastline_setup command.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Enable the monitoring user

    To enable the monitoring user, type new_monitoring_user_password password.

    -> new_monitoring_user_password s3cretP4ssw0rd

    Your password selection must meet the requirements specified on the passwd command man page.

    You can also enable the monitoring user with the monitoring_user_password option.

  3. Optional: View the status of the monitoring user

    If you type the new monitoring_user_password option without an argument, the obfuscated password is displayed.

    -> new_monitoring_user_password
    new_monitoring_user_password: ***

    If you type the monitoring_user_password option without an argument, the status of the monitoring user is displayed.

    -> monitoring_user_password
    monitoring_user_password: enabled; pending password change

    The "pending password change" text indicates that your change has not yet been saved.

  4. Optional: Disable the monitoring user

    To disable the monitoring user account, use the dash (-) argument:

    -> monitoring_user_password -

    The dash (-) argument to the new monitoring_user_password option clears the password:

    -> new_monitoring_user_password -
  5. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

  6. Optional: Add your public key to the monitoring user

    You can optionally copy your public key from the lastline account (see Enable SSH access, 3):

    lastline@lastline-manager:~$ sudo tail -n 1 ~/.ssh/authorized_keys >> ~monitoring/.ssh/authorized_keys
    [sudo] password for lastline:
    
    lastline@lastline-manager:~$ sudo cat ~monitoring/.ssh/authorized_keys
    ssh‑rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNrBpwY54v4XDePpQlDOBNpQpyBuJnPY3ThAE3YPAtqlboKeiUNDDgHbYLVVdXV8CFpvShaJ1oFZj5CNjp4krD9Bx2aK3QpoRX3e3ZWSv2JxlbBs61J4fTiKnyDyeGcqx3Q2JjgRTww5AfE4c5GYZrpPTG5UkKfd6Jl8Pq1qyatHWXhCTpquOqPB1lTmS0f2gna8CMVyunV1CLVhmQVeNU2EgGQMh2wJpxO59ohNVD950HJM6lJiQVoAk7nAoJvvcHkCmrB7SSVN7xv2FIthYswVWnPU58BELwJazCu7qKcxKt0T6MdVhnZSiv64M56EBUJyXd7F3 admin@example.com

    Now you can log out of lastline user session and then use the ssh command from your local system to access the VMware NSX Network Detection and Response appliance.

    admin@host:~$ ssh monitering@manager.example.com
    Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-171-generic x86_64)
    
    monitoring@lastline-manager:~$

Throughout the rest of this guide, you can substitute the monitoring user wherever the lastline user is required.

Network Configuration

The VMware NSX Network Detection and Response supports easily changing the network configuration of its appliances. This update may be required if assigned IP addresses change (for example, upon a reconfiguration of the network) or if you choose to switch from static addressing to DHCP or vice versa.

Reconfigure for DHCP

To reconfigure the network configuration of a VMware NSX Network Detection and Response appliance to DHCP, use the network option of the lastline_setup command.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Check the network settings

    To check the current network settings, type network.

    -> network
    network dns_nameservers = 8.8.8.8 8.8.4.4
    network gateway = 10.0.2.2
    network netmask = 255.255.255.0
    network address = 10.0.2.15
    network interface = eth0
    network method = static
  3. Enable DHCP configuration for network access

    To enable DHCP addressing, type network method dhcp.

    -> network method dhcp
    network method = dhcp  # changed; original value: static
  4. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Reconfigure for Static Addressing

To reconfigure the network configuration of a to use a static IP address or to update to a new IP address, you must provide or replace values for the address, netmask, gateway, and dns_nameservers parameters. Use the network option of the lastline_setup command to make these changes.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Check the network settings

    To check the current network settings, type network. This example shows the VMware NSX Network Detection and Response appliance is currently using DCHP:

    -> network
    network interface = eth0
    network method = dhcp
  3. Enable static configuration for network access

    To enable a static IP address, type network method static.

    -> network method static
    network method = static  # changed; original value: dhcp

    This step is only needed if the appliance is currently using DCHP.

  4. Set the network address

    To set the IP address, type network address ip_address. Use an IPv4 address of four octets.

    -> network address 10.0.2.15
    network address = 10.0.2.15  # changed; original value:
  5. Set the netmask

    To set the netmask, type network netmask netmask. Use an IPv4 netmask of four octets.

    -> network netmask 255.255.255.0
    network netmask = 255.255.255.0  # changed; original value:
  6. Set the gateway address

    To set the gateway IP address, type network gateway ip_address. Use an IPv4 address of four octets.

    -> network gateway 10.0.2.2
    network gateway = 10.0.2.2  # changed; original value:
  7. Set the DNS server address(es)

    To set the DNS server IP address, type network dns_nameservers ip_address [ip_address]. Use an IPv4 address of four octets for each address.

    -> network dns_nameservers 10.2.1.1 10.2.2.1
    network dns_nameservers = 10.2.1.1 10.2.2.1  # changed; original value:
  8. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

SMTP notifications

The Manager can be configured to send notifications or reset account passwords using email. To configure the way email messages are sent, use the email options of the lastline_setup command.

Note:

The Sensor can be configured to either passively or actively monitor and/or filter all email traffic into your network. See Configure email monitoring for further details and configuration options.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Specify the SMTP relay host

    To specify an SMTP relay host for delivering email messages, type email_relay_host fqdn.

    -> email_relay_host smtprelay.example.com
    email_relay_host = smtprelay.example.com  # changed; original value:
  3. Specify the SMTP relay port

    To specify the port the SMTP relay host is listening on, type email_relay_port portnumber.

    -> email_relay_port 25025
    email_relay_port = 25025  # changed; original value:
  4. Specify the SMTP user

    To specify the username to use when authenticating to the SMTP relay host (if required), type email_relay_username username.

    -> email_relay_username admin
    email_relay_username = admin  # changed; original value:
  5. Specify the SMTP password

    To specify the password to use when authenticating to the SMTP relay host (if required), type email_relay_password password.

    -> email_relay_password adminpassword
    email_relay_password = adminpassword  # changed; original value:
  6. Specify the SMTP address

    To specify the address from which to send emails, type email_sender_address emailaddress.

    -> email_sender_address admin@example.com
    email_sender_address = admin@example.com  # changed; original value:
  7. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Configure Analysis Traffic Routing

The VMware NSX Network Detection and Response provides an analysis sandbox running on the Manager and Engine to examine suspicious files or URLs. The sandbox simulates various environments, including Windows 7, Windows 10, Microsoft Office, Chrome, a generic browser, and a PDF file viewer. Inside the simulated environment, the sandbox attempts to run the potentially malicious file or URL and analyzes the results of the execution.

In many cases, the runtime environment attempts to access resources on the Internet. To protect your environment and anonymize the public IP address of your client connections, the Manager is configured by default to route traffic generated inside its analysis sandbox to the Internet via a secure tunnel. This tunnel component is called AnonVPN (Anonymization VPN).

In addition to anonymizing the public IP address, AnonVPN periodically rotates the IP address with which connections to the Internet are made to avoid getting blocked when connecting to malware command-and-control infrastructure. The tunnel also prevents malware running inside the sandbox from accessing services in the local network. By routing traffic to outside the local network, only services reachable via public IP addresses are accessible to programs running inside the sandbox.

Note:

If your installation uses the Engine to perform suspicious content analysis, AnonVPN routes analysis traffic generated inside in its sandbox through the Manager to the Internet. AnonVPN only needs to be configured on Manager.

If you cannot make use of the AnonVPN feature, the lastline_setup command allows you to specify an alternate method for routing network connections. The following three modes are supported:

  • lastline Analysis traffic is routed via a secure tunnel. This is the default configuration.

  • honeypot Analysis traffic is not routed to the Internet. Instead any connections established inside the sandbox are redirected to a honeypot on the appliance.

  • custom Analysis traffic is routed via a dedicated interface that you have configured.

Configure Default AnonVPN

Manager uses AnonVPN to route traffic originating in the analysis sandbox. The VPN routes only outgoing connections and response packets. It blocks any in-bound connections.

The lastline mode of AnonVPN is the system default. It only needs to be configured if you had previously implemented one of the other modes.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Select the default VPN connection

    To re-enable the default mode of AnonVPN, set the lastline parameter of the anonvpn_mode option.

    -> anonvpn_mode lastline
    anonvpn_mode = lastline  # changed; original value:
  3. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Configure Honeypot AnonVPN

The VMware NSX Network Detection and Response provides a secure tunnel for traffic generated inside the analysis sandbox, AnonVPN (Anonymization VPN), anonymizing the public IP address of client connections. For installations that cannot use the VMware infrastructure due to security or privacy requirements, a honeypot mode is available.

In this mode, analysis traffic is not routed to the Internet. Instead any connections established inside the sandbox are redirected to the honeypot on the appliance. This supports the analysis of artifacts in a completely isolated network, without any outgoing connectivity. Because samples undergoing analysis may attempt to access resources on the Internet, the system emulates a set of services that use well-known protocols, such as (but not limited to) DNS, FTP, HTTP, HTTPS, and SMTP.

Any outgoing traffic using an unknown protocol is blocked to avoid accessing services in the local network.

Note:

In honeypot mode, the analysis of URLs in the sandbox will fail. Since no traffic is allowed out to the Internet, when a sample attempts to access a URL, the connection fails, and an error is reported. As a consequence, the URL analysis fails and no report is generated.

When running a honeypot without connectivity to the VMware backend, you should disable the cloud analysis component to avoid the timeout waiting for analysis metadata.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Select the honeypot VPN connection

    To enable the honeypot mode of AnonVPN, set the honeypot parameter of the anonvpn_mode option.

    -> anonvpn_mode honeypot
    anonvpn_mode = honeypot  # changed; original value: lastline
  3. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Configure Custom AnonVPN

To customize routing of analysis traffic, you must configure a dedicated network interface on the system hosting the Manager using its /etc/network/interfaces configuration file (see the interfaces.5 man page).

The dedicated interface can be a physical interface (such as eth3) or a virtual interface (such as an OpenVPN tunnel interface tun0). This interface has the following requirements:

  • The interface must be configured in /etc/network/interfaces.

  • The interface must use IPv4.

  • The interface must either use a static IP address or configured to invoke the /etc/anonvpn/routing_interface_up.sh command when it is assigned an IP address.

    The routing_interface_up.sh command is needed to trigger the setup of packet routing. For OpenVPN connections, the command can be invoked using the --up parameter.

  • The interface must not be called llanonvpn0 or llanonvpn1. These interface names are reserved for connecting the Engine to the Manager and for interfaces in AnonVPN lastline mode.

In addition to the interface configuration, you must provide the following information to enable custom routing:

DNS server IP address

The IPv4 address of the DNS server which will be used for resolving domains inside the analysis sandbox. The DNS server must be reachable over the provided interface. DNS requests from the analysis engine will be routed over the same link as other analysis traffic.

Gateway IP address

The IPv4 address of the gateway for routing packets on the custom interface. The gateway address must not be configured via /etc/network/interfaces to avoid routing non-analysis traffic via this interface.

To switch to a custom network interface for the analysis sandbox, ensure that the dedicated interface is up (use ifup interface-name, for example, ifup tun0) and then configure the AnonVPN options of the lastline_setup command.

Important:

It is possible to route analysis traffic via the primary network interface on Manager. This configuration is highly discouraged as it gives the sample under analysis full access to your local network. It is your responsibility to block any potentially malicious connections routed this way.

The routing of analysis traffic via a custom network interface does not use a proxy even if one is configured.

Configure the Manager to use a custom VPN connection to route traffic originating inside the analysis sandbox. This VPN only routes outgoing connections and response packets. Thus, the VPN blocks any in-bound connections.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Specify a custom VPN connection

    To enable the custome mode of AnonVPN, set the custom parameter of the anonvpn_mode option.

    -> anonvpn_mode custom
    anonvpn_mode = custom  # changed; original value: lastline
  3. Specify the interface for the VPN connection

    To select the interface to use for the custom VPN connection, type anonvpn_upstream_ifname interface-name.

    For example, using a virtual interface such as OpenVPN:

    -> anonvpn_upstream_ifname tun0
    anonvpn_upstream_ifname = tun0  # changed; original value:

    For example, using a physical interface:

    -> anonvpn_upstream_ifname eth3
    anonvpn_upstream_ifname = eth3  # changed; original value:
  4. Specify the DNS server for the VPN connection

    To select the DNS server to use for the custom VPN connection, type anonvpn_dns_server_ip ip_address. Use an IPv4 address of four octets. For example, 8.8.4.4 for the public Google DNS servers.

    -> anonvpn_dns_server_ip 8.8.4.4
    anonvpn_dns_server_ip = 8.8.4.4  # changed; original value:
  5. Specify the gateway for the VPN connection

    You must specify a gateway when you use a physical interface for the custom VPN connection. It is optional for virtual interfaces.

    To select the gateway, type anonvpn_upstream_gateway_ip ip_address. Use an IPv4 address of four octets.

    -> anonvpn_upstream_gateway_ip 10.0.0.1
    anonvpn_upstream_gateway_ip = 10.0.0.1  # changed; original value:
  6. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Configure the Analysis Upload-Size Limit

By default, the VMware NSX Network Detection and Response rejects uploads of files for analysis that are larger than 10 MB. This value provides a reasonable compromise between the ability to analyze the vast majority of malicious artifacts and having to store overly large files. If required, you can modify this limit up to 200 MB.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Modify the size limit for uploads

    To modify the size limit for files that can be uploaded, type analysis_max_upload_filesize_mb size. Specify the size which can be from 10 through 200.

    -> analysis_max_upload_filesize_mb 200
    analysis_max_upload_filesize_mb = 200  # changed; original value:
  3. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Configure Data Retention

The VMware NSX Network Detection and Response tracks all of the stored files on the appliance and issues a notification through the User Portal interface when usage of the local file-system disk exceeds certain thresholds.

Periodically, large analysis artifacts (such as the metadata that an analysis generates), are deleted according to data-retention policies that can be updated using the lastline_setup command. The following is a full list of data-retention options:

To avoid specific file-types from being affected by the data-retention policies, you can use the value unlimited (or 0).

The following steps show how to define your configuration to discard files generated during an analysis run after 90 days, but to keep files uploaded for analysis indefinitely:

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Modify the retention for generated files

    To retain generated files to 90 days, type data_retention_generated_files 90.

    -> data_retention_generated_files 90
    data_retention_generated_files = 90 days  # changed; original value:
  3. Modify the retention for uploaded files

    To retain uploaded files indefinitely, type data_retention_uploads unlimited.

    -> data_retention_uploads unlimited
    data_retention_uploads = unlimited  # changed; original value:
  4. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Configure Cloud Analysis

The VMware NSX Network Detection and Response cloud analysis component extends analysis results generated in the local On-Premises installation by querying and sharing data with the VMware backend.

This component allows an individual installation to contribute to and benefit from the global intelligence collected by VMware, Inc.. As a consequence, the analysis results generated when cloud analysis is enabled may be more accurate and may contain additional pieces of information (such as, file origin information, threat classification, more up-to-date analysis results). At the same time, sharing data with VMware, Inc. may not be desirable or even allowed in certain situations. Therefore, the cloud analysis component offers a number of configuration options to let you decide exactly what information gets shared.

  • cloud_analysis When this option is enabled, your installation shares the hashes (MD5, SHA1, and SHA256) of the analyzed artifacts with the VMware backend. For file artifacts, the actual content is not uploaded to the VMware backend.

  • cloud_analysis_push_download_source When this option is enabled, your installation shares the IP address and hostname of the server where the artifact was downloaded from with the VMware backend.

  • cloud_analysis_push_download_metadata When this option is enabled, your installation shares the URL where the artifact was downloaded from (HTTP, FTP, and SMB downloads) with the VMware backend. In the case of HTTP downloads, the referrer information is also shared, if available.

  • cloud_analysis_query_url_reputation When this option is enabled, your installation queries the VMware backend for metadata that can be included in the URL classification. Note that the full URL is shared with the VMware backend.

When the analysis system detects a malicious file or URL, it is possible to notify the VMware backend about the detection by uploading the artifact content. Sharing this information helps us and the security community by increasing the global intelligence, while limiting your sharing to malicious files minimizes the risk of exposing sensitive files.

To configure the sharing of malicious files, review the Data sharing tab of the Appliances Configuration pages provided by the User Portal running on your Manager.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Disable sharing hashes

    The sharing of hashes with the VMware backend can be disabled by typing cloud_analysis off.

    -> cloud_analysis off
    cloud_analysis = off  # changed; original value: on
  3. Disable sharing download details

    The sharing of artifact source details with the VMware backend can be disabled by typing cloud_analysis_push_download_source off.

    -> cloud_analysis_push_download_source off
    cloud_analysis_push_download_source = off  # changed; original value: on (value not set)
  4. Disable sharing artifact origin details

    The sharing of artifact origin details with the VMware backend can be disabled by typing cloud_analysis_push_download_metadata off.

    -> cloud_analysis_push_download_metadata off
    cloud_analysis_push_download_metadata = off  # changed; original value: on (value not set)
  5. Enable querying URL metadata

    Querying the VMware backend for URL metadata can be enabled by typing cloud_analysis_query_url_reputation on. By default, this option is off.

    -> cloud_analysis_query_url_reputation on
    cloud_analysis_query_url_reputation = on # changed; original value: off (value not set)
  6. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Configure the Analysis Queue

In certain situations, it can be convenient to automatically drop tasks scheduled for analysis from the queue. This way even systems with limited resources can guarantee analyzing submitted artifacts in a timely manner, even when temporarily overloaded with a large number of submission.

The VMware NSX Network Detection and Response allows this by a configuration option that automatically deletes tasks from the analysis queue that have been pending for more than the specified number of days.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Specify the number of days of the analysis queue backlog

    To specify the number of days tasks may remain in the analysis queue backlog, type analysis_queue_backlog days.

    -> analysis_queue_backlog 12
    analysis_queue_backlog = 12 days  # changed; original value: unlimited

    The default is unlimited. Typing this option without an argument displays its current value.

  3. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Configure Remote Assistance

By default, VMware NSX Network Detection and Response provides a mechanism to allow the VMware Support team to perform remote administration assistance on your Manager, when requested. You can disable this access with the lastline_setup command.

Note:

Should you need to contact VMware Support, the VMware, Inc. technician will probably request that you temporarily re-enable the support channel.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Disable VMware Support remote access

    To disable VMware Support access to your appliances, type disable_support_channel true.

    -> disable_support_channel true
    disable_support_channel = true  # changed; original value:
  3. Save the configuration

    After you provide all the required parameters, save your configuration.

    -> save

    The save option updates the configuration, applies any needed changes, then quits the lastline_setup command.

Show the configuration

To view the current configuration of the VMware NSX Network Detection and Response appliance, use the show option of the lastline_setup command.

  1. Start the setup command

    From the command line of the VMware NSX Network Detection and Response appliance, execute the lastline_setup command.

    lastline@lastline-manager:~$ lastline_setup

    If you are prompted for the sudo password, use the password for the default lastline user account.

  2. Show the current configuration

    To view the current configuration of the appliance, type show. The following example shows the results on the Manager:

    -> show
    analysis_max_upload_filesize_mb = 100
    analysis_queue_backlog = unlimited
    anonvpn_dns_server_ip =
    anonvpn_mode = lastline
    anonvpn_upstream_gateway_ip =
    anonvpn_upstream_ifname =
    appliance_state = active
    appliance_uuid = 09036b88a68a47c99fde25ce10479f44
    cloud_analysis = on
    cloud_analysis_push_download_metadata = on
    cloud_analysis_push_download_source = on
    cloud_analysis_query_url_reputation = off (value not set)
    data_retention_code = 60 days
    data_retention_generated_files = 21 days
    data_retention_memory_dumps = 7 days
    data_retention_process_dumps = 21 days
    data_retention_screenshots = unlimited
    data_retention_traffic_captures = unlimited
    data_retention_uploads = unlimited
    data_retention_webpages = 21 days
    disable_report_commenting =
    disable_support_channel =
    email_relay_host =
    email_relay_password = ***
    email_relay_port =
    email_relay_username =
    email_sender_address =
    failover_multicast_address =
    failover_multicast_port =
    failover_virtual_ip = 10.10.42.241
    fqdn = manager.tse.int.lastline.com
    heartbeats = on
    https_proxy =
    image_brand_replacement = off (value not set)
    license_api_token = ssOrE3gKBCYGyWz6
    license_key = 0Z6LLNOU4ZP12BWBTOJ0
    llama_images_server_override =
    monitoring_user_password: enabled
    network dns_nameservers = 8.8.8.8 4.4.4.4
    network gateway = 10.10.42.250
    network netmask = 255.255.255.0
    network address = 10.10.42.242
    network interface = eno1
    network method = static
    new_monitoring_user_password = ***
    ntp_server = update.lastline.com
    ntp_servers = update.lastline.com
    offline_mode =
    text_brand_replacement =
  3. Exit the configuration tool

    To quit from the configuration tool without saving your changes, type exit.

    -> exit
    lastline@lastline-manager:~$

Update Fully Qualified Domain Name

You can update the FQDN of the VMware NSX Network Detection and Response appliances. On the Manager, this update creates a new self-signed certificate associated with the FQDN.

Important:

After you complete the following steps on the Manager, you must update all the appliances managed by Manager to use its new FQDN (see 2).

This process does not allow you to move appliances from one Manager to another.

Applying an FQDN to other appliances such as the Data Node or Engine is entirely optional. These appliances are already known to the Manager. Most direct access is at best undesirable.

  1. Use the change FQDN option

    From the command line of the Manager, execute the lastline_register command, providing the new local FQDN for the appliance as an argument.

    lastline@lastline-manager:~$ lastline_register --change-local-fqdn new_manager.lastline.example.com
    Note:

    If you are prompted for the sudo password, use the password for the default lastline user account.

    On the Manager, the command generates a new self-signed certificate. If needed, you can replace the certificate.

  2. Update the Manager FQDN

    SSH to each managed appliance (Sensor, Data Node, and Engine). Run the lastline_register command with the change-active-manager-fqdn option. Provide the new FQDN for the Manager as its argument. For example:

    lastline@lastline-sensor:~$ lastline_register --change-active-manager-fqdn new_manager.lastline.example.com
    Note:

    If you are prompted for the sudo password, use the password for the default lastline user account.

    If the Manager is using a self-signed SSL certificate, the appliance needs to be configured to trust the new SSL certificate to ensure all communication succeeds. Use the following commands instead:

    lastline@lastline-sensor:~$ lastline_register -C --change-active-manager-fqdn new_manager.lastline.example.com
    lastline@lastline-sensor:~$ lastline_test_appliance --auto-fix network:master_api_query
    lastline@lastline-sensor:~$ lastline_apply_config -f

    If the Manager IP address is assigned statically, the following command can be used to update /etc/hosts to point to its new address:

    lastline@lastline-sensor:~$ lastline_register --change-active-manager-ip 192.20.24.42

    You can combine both options into a single command:

    lastline@lastline-sensor:~$ lastline_register --change-active-manager-fqdn new_manager.lastline.example.com --change-active-manager-ip 192.20.24.42
    lastline@lastline-sensor:~$ lastline_test_appliance --auto-fix network:master_api_query
    lastline@lastline-sensor:~$ lastline_apply_config -f

Appliance Management API

The VMware NSX Network Detection and Response provides the Appliance Management API as an interface to configure or re-trigger a configuration on an appliance.

The easiest way to invoke the Appliance Management API is to download and use the NSX PAPI client implementation.

Enable shell timeout

The setting interactive_shell_timeout allows a configurable timeout for the duration that an interactive shell can idle before Bash terminates it.

By default the value is set to 0 which means no timeout.

Warning:

Note that setting a shell timeout can lead to long running commands running in interactive shells being interrupted before they can complete. Therefore, if this setting is configured, we recommend that administrative tasks that require running any potentially long-running shell commands be run within a tool such as screen or tmux that can allow the commands to complete even after the shell times out.

Configuring the shell timeout

The setting can be configured using the Lastline Appliance Management API method appliance_mgmt.action_request by providing the setting interactive_shell_timeout with a value in seconds.

The following API parameter values are required:

  • appliance_uuid You can obtain the appliance_uuid from the User Portal. Navigate to the AdminAppliancesStatus page. Scroll down to the Appliance UUID entry. The UUID can also be retrieved using the accounting API.

  • action_type The action type CONFIGURE should be used to configure an appliance.

  • action_parameters The JSON encoded object: '{"settings": {"appliance::user::interactive_shell_timeout": 600}}'

An example of using the Lastline Appliance Management API to configure this setting would look like the following command using curl:

$ curl --cookie lastline-cookie \
       --data 'appliance_uuid=a2a241d655f741969d12fbaadae795ac' \
       --data 'action_type=CONFIGURE' \
       --data 'action_parameters={"settings": {"appliance::user::interactive_shell_timeout": 600}}' \
       --request POST 'https://<FQDN>/papi/appliance_mgmt/action/request'

The session cookie (--cookie lastline-cookie) can be obtained by following the Authentication Quick-Start guide.

Alternatively, you can use the NSX PAPI software from the User Portal with the following command:

client.appliance_mgmt.configure(
    appliance_uuid=appliance_uuid,
    settings={
        "appliance::user::interactive_shell_timeout": 600,  # 10 minute timeout
    }
)

The following API parameter values are required:

  • appliance_uuid You can obtain the appliance_uuid from the User Portal. Navigate to the AdminAppliancesStatus page. Scroll down to the Appliance UUID entry. The UUID can also be retrieved using the accounting API.

  • settings Type and version specific settings to configure on the appliance.

User Portal

The User Portal (Web UI) provides support for both the Administrator and the Analyst roles. The Administrator uses the User Portal for configuration and management tasks.

Login to the User Portal

You access the User Portal with your web browser. The VMware NSX Network Detection and Response supports the following browsers:

You must use a recent version of your selected browser to ensure compatibility plus the most up-to-date security patches. The system is tested and warranted to work correctly with the listed browsers. Other modern browsers might also work correctly however VMware cannot support any issues you may encounter when using unsupported software.

  1. Connect to the User Portal

    Using your web browser, connect to the User Portal (Web UI):

    For On-Premises installations, use the portal running on the Manager, for example, https://user.lastline.example.com/.

    For Hosted customers, go to the User Portal at https://user.lastline.com/ (for EMEA customers https://user.emea.lastline.com/).

  2. Enter your VMware username and password

    On the Log in to the Lastline Portal page, enter your Username and Password then click the Sign in button.

    Note:

    This is your User Portal username. For On-Premises installations, the initial administrator account was generated using this username and password during registration of the Manager.

    If you have forgotten your password, the VMware NSX Network Detection and Response provides a password reset service. Click the Forgot your password? link on the portal login page.

    For your first login, the User Portal displays the Dashboard:Overview page. On any subsequent login, the page you last visited is displayed.

  3. Access the main menu

    The Main navigation menu is displayed across the top of the page under the logo header. This menu allows you to access the corresponding top-level pages of the User Portal:

    • Dashboard Displays an overview of the threats in your network and provides general visibility into the devices on the network.

    • Network Displays information about your network including the currently known intrusions and recent incidents and events.

    • Email Displays mail attachments.

    • Investigation Investigate intrusions and events, using a graphical representation of entities in your network.

    • Analyst Submit artifacts (files and URLs) for analysis.

    • Intelligence Search the Knowledge Base for analysis artifacts (for example, files, IP addresses, domains).

    • Admin Administration Settings for configuring accounts, licenses, and appliances.

    Note:

    Depending on your license, some of the items in the Main navigation menu may be unavailable.

  4. Optional: Set the appearance

    By default, the appearance of the User Portal matches the system default. Click the Switch to dark mode icon / Switch to light mode icon icon to access the drop-down menu that allows you to toggle the appearance. Select Light, Dark, or System Default.

  5. Optional: Access the help and other documentation

    Click the Help button icon icon to access the drop-down help menu. Use the menu to access the following pages: Release Notes, Portal guide, API docs. Downloads, and Manuals.

  6. Access your user settings or exit

    Click Your User ID angle down to access the pull-down menu. Select cogs (multiple actions) Settings to modify your personal settings or logout Logout to exit the User Portal.

Dashboard pages

The dashboard pages provide a general overview of the status of the VMware NSX Network Detection and Response installation and its observed events. The various widgets and lists on these pages display a high-level view of all relevant information related to your setup and the observed events.

You are redirected to the dashboard pages at each login to the User Portal. There are four predefined dashboard pages:

  • Overview
  • Network
  • Mail
  • Files

Most of the widgets and lists are intended to help the Analysts role. The dashboard widget designed to be the most useful for the Administrator is the Sensors Status widget.

Sensors status widget

The Sensors Status widget provides a quick snapshot of the status of the Sensor appliances deployed in your VMware NSX Network Detection and Response installation. Each of the status field buttons Up, Monitoring, ICAP, Mail, or Integrations displays a ratio of status:server and are also color-coded.

Sensors Status widget

Click the plus button to display a list of the deployed appliances. You can also click any of the status field buttons to toggle the display of the list.

Click the reload button to refresh the display.

Status list

The Sensor appliances list displays the following fields:

  • Name Displays the name of the Sensor. Click the plus button to display a detailed view of the appliance.

  • Up Displays the running status: Running, The sensor is offline, etc.

  • Monitoring Displays the monitoring status.

  • ICAP Displays the ICAP status.

  • Mail Displays the email filtering status.

  • Integration Displays the status of integrations with services such as Active Directory, SIEM servers, etc.

Manage users

Use the Admin Accounts page to add and manage users on the User Portal.

The VMware NSX Network Detection and Response supports two basic user roles: the Administrator and the Analyst. In addition, there is a Read only role. You edit users to assign one of the roles to their accounts. Alternatively, you can use permissions to assign more granular access to users.

The Accounts page consists of the following tabs:

  • My account Administer your user account and permissions.

  • All accounts Manage existing accounts.

  • Add account Create a new user account.

  • Audit log View user access and actions.

About roles

A Role defines a set of permissions that you can apply to user accounts on the User Portal. A set of built-in roles are provided.

Using the Lastline API, you can create custom roles.

Roles descriptions
Administrator

This role is for an administrator. It provides full read-write access to all functions of the User Portal. This role has the following permissions:

Analyst

This role is for a full-fledged analyst. A user with this role can view most of data on system and operate on network/detection data. This role has the following permissions:

Read only

This role is for read-only access. It provides broad access to view the configuration and detection data, but no ability to make any kind of modifications. This role has the following permissions:

About permissions

Permissions define the specific system access rights granted to a user. These permissions can be fined tuned to different levels of granularity. Editing an account allows you to set specific permissions for each user.

Permissions are tiered. Each permission tier supersedes the tier below.

Customer

Permissions set on the customer tier will grant an account these permissions globally across your environment and on all licenses and subkeys.

License

Permissions set on a license will grant an account these permissions on that license and all its subkeys.

See About licenses for details about licensing.

Subkey

Permissions set on a subkey will grant an account permissions on that subkey only.

See About licenses for details about licensing.

Permission descriptions
Administrator

Tiers: Customer

Allows a user to manage other user accounts, such as creating new accounts, modifying or blocking existing accounts, and changing the password of other accounts. It also allows a user to manage licensing. This includes editing license details as well as creating new Sensor subkeys.

The Administrator permission implies all other permissions, so administrator accounts can perform all operations available through the User Portal and API.

Can access alerts

Tiers: Customer License Subkey

Allows a user to view alerts and statistics from protected networks. It also allows viewing the status, monitoring logs and metrics from Sensor appliances. This permission can be granted globally, or limited to specific licenses or subkeys.

Can access analyzed files

Tiers: Customer

Allows a user to download the original files submitted for analysis, when these are of a file type that is considered less sensitive, such as executables and scripts.

Can access Kibana

Tiers: Customer

Allows a user to access network traffic analysis records using the Kibana visualization tool.

Can access pcaps

Tiers: Customer License Subkey

Provides access to additional information collected from a protected network. Currently, this controls access to traffic captures (PCAPS) as well as the associated DNS data.

This permission can be granted globally, or limited to specific licenses or subkeys. It can be granted in addition to Can access alerts.

Can access sensitive analyzed files

Tiers: Customer

Allows a user to download the original files submitted for analysis when these are of a file type that is considered more sensitive, such as Office or PDF documents.

This permission can be granted in addition to Can access analyzed files.

Can be workflow assignee

Tiers: Customer License Subkey

Ability to be assignee for workflow items (for example, campaigns).

Can manage appliances

Tiers: Customer License Subkey

Allows a user to view and manage appliance configurations. It also allows a user to install new appliances, as well as re-register or de-register existing appliances.

This permission can be granted in addition to Can view appliances.

Can manage custom threat intelligence entries

Tiers: Customer

Ability to manage custom intelligence entries.

Can manage intelligence alerting rules

Tiers: Customer

Permission to manage rules set to alert a customer when a matching artifact is indexed by the intelligence platform.

Can manage labels

Tiers: Customer License Subkey

Controls access to several features:

  • Allows a user to make use of the incident workflow functionality available in the incidents tab, such as the ability to close and open incidents.

  • Allows a user to configure network-related display settings. These are the Home Network, the silenced IP Range and the host labels.

  • Allows a user to configure notification integrations for sending notification by email, syslog, or other mechanisms when an event happens.

  • Allows a user account to push detection information about a monitored network into the system through the Push Detection API. This can be used for integration with third party products.

This permission can be granted globally, or limited to specific licenses or subkeys.

Can set password

Tiers: Customer

Allows the user to set, change, or reset the account password. This permission is usually set by default.

Can view appliances

Tiers: Customer License Subkey

Allows a user to view the status of appliances. This includes access to the status, log, and metrics views of the appliance management UI.

Can view benign emails

Tiers: Customer

Ability to view information about benign emails observed in a protected network.

Can view custom threat intelligence entries

Tiers: Customer

Ability to get a listing of all custom threat intelligence entries and full information on individual entries.

Can view emails

Tiers: Customer License Subkey

Ability to view information about emails observed in a protected network.

Can view intelligence alerting rules

Tiers: Customer

Ability to view matches and rules set to alert a customer when a matching artifact is indexed by the intelligence platform.

View users

The All accounts tab displays a list of the users defined on the User Portal.

  1. Navigate to the All accounts tab

    From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Accounts page, click the All accounts tab.

  2. Search for a specific user

    The quick search field above the list provides fast, as-you-type search. It filters the rows in the list, displaying only those rows that have text, in any field, that matches the query string.

  3. Re-sort the list of users

    By default, the list is sorted by Username. You can sort the list by Name, Email, or Blocked. Click the sort icon in the header beside each column title.

  4. Edit a user

    Click the edit icon for the selected user. Then edit the settings for that user account on the Account Settings page.

  5. Delete a user

    Click the delete icon. Then click Yes in the Delete confirmation pop-up.

    Important:

    You should avoid deleting users. When a user is deleted, important history for that user account is also deleted. Instead you should Block the user account.

  6. Block a user

    To block a user, click the lock icon. Then click Yes in the Confirm block pop-up.

    To later unlock a blocked user. Click the lock icon again.

    Important:

    Blocking is the preferred method of disabling a user's access to the User Portal.

Add a user

Create a new user account on the Add account tab.

  1. Navigate to the Add account tab

    From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Accounts page, click the Add account tab.

  2. Enter a username

    In the Username field, type a user name. We recommend that the user name be an email address, however any text string is a valid user name.

  3. Enter a password

    In the Password field, type a password.

    By default, the password must be at least 12 characters.

    Note:

    VMware NSX Network Detection and Response uses the zxcvbn library (developed and shared by Dropbox) to enforce strong passwords on the User Portal. It applies various heuristics to ensure your password cannot be easily cracked.

    These heuristics are applied when you click create/save the user account. If the zxcvbn library determines that the entered password is too easily cracked, an error message is displayed at the top of the page, and the create/save operation terminates. Enter a more rigorous password.

    VMware recommends the use of a password manager to generate and recall strong passwords.

    In the Confirm password field, re-enter the password.

  4. Enter the user's name

    In the First, last name fields respectively, type the user's first and last name.

  5. Enter an email address

    In the Email address field, type the user's email address.

  6. Select the timezone

    Select the Default timezone for the user from the pull-down menu. This timezone is used as the default timezone for all security-related reporting for the user.

  7. Complete the new user account

    Click Create to add the new user account.

    The User Portal creates the user account, then loads the Account Settings page.

    A new user account is assigned default permissions. You must update the account to add a role or to add or modify its permissions. See Configure role and permissions.

Set primary customer account

Each VMware customer, whether Hosted or On-Premises, is represented by a Primary customer account. The primary customer account is shown on the Admin Accounts License information tab. This information is used by VMware for billing notifications, to send out information about product updates and, if required, as the main contact person regarding questions about your VMware NSX Network Detection and Response installation.

  1. Navigate to the All accounts tab

    From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Accounts page, click the All accounts tab.

  2. Select a user account

    Scroll through the users list until you find the appropriate account, username. Click the edit icon for that user.

    The Account Settings page is displayed.

  3. Assign the primary customer account

    Scroll down and click the plus icon to open the Advanced settings section. Then click the Make username the primary account button.

Configure role and permissions

A new user account is assigned default permissions. You must update the account to add a role or to add or modify its permissions.

The Roles section allows you to set or remove the roles assigned to a user account. See About roles for details about the different roles available.

The Permissions section allows you to modify the individual permissions for a user account. See About permissions for details about the different permissions available.

You modify the role and permissions of the user account on the Account Settings page. This page is loaded after you click create on the Add account tab or when you click the edit icon for a specific user on the All accounts tab.

  1. Navigate to the All accounts tab

    From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Accounts page, click the All accounts tab.

  2. Apply a role to the user

    Click the add roles plus button to add a role to a user account. In the roles dialog, select the Administrator, Analyst, or Read only role to be added. You can assign more than one role to a user.

    To remove a role, click checkbox on the role to be removed. In the Confirm role removal prompt, click Remove role.

  3. Apply permissions to the user

    By default, permissions are only enabled at the Customer tier. If you want to restrict a user to a specific license or subkey, you must first enable those tiers.

    To add a permission, click the add permission plus button. In the permission dialog, select the permissions to be added.

    To remove a permission, click checkbox on the permission to be removed. In the Confirm permission removal prompt, click Remove permission.

    1. Enable the license tier

      Click Add license plus , then select a License from the pull-down menu, and click Select license.

      The Add license permission dialog is displayed, allowing you to add permissions for the selected license.

      Note:

      You can add multiple licenses up to the number of available licenses.

    2. Enable the subkey tier

      Click Add subkey plus , then select a License and Sensor from the pull-down menus, and click Select subkey.

      The Add subkey permission dialog is displayed, allowing you to add permissions for the selected sensor.

      Note:

      You can add multiple subkeys.

Edit a user

You edit user accounts on the Account Settings page. Change the password, update the email address, etc. This page is loaded after you click create on the Add account tab or when you click the edit icon for a specific user on the All accounts tab.

Also see Set primary customer account and Configure role and permissions.

  1. Change the password

    In the Password field, enter a new password.

    In the Confirm password field, re-enter the password.

  2. Change the user's name

    In the First, last name fields respectively, update the user's first and last name.

  3. Change the email address

    In the Email address field, update the user's email address.

  4. Change the timezone

    Modify the Default timezone from the pull-down menu.

Audit users

The Audit log tab allows you to view the access and actions of all of the users of the User Portal.

You can apply filters to the audit log list. Select an item to Filter by from the pull-down menu.

Use the Quick search field to display only those entries that have text, in any field, that matches your query string.

Scroll through the list to find audit events that of interest. Click the plus icon (or anywhere on an entry row) to expand a specific entry.

Manage licenses

Use the Admin Licensing page to manage the licenses of your VMware NSX Network Detection and Response installation.

Your account will have at least one license provisioned by VMware. Depending on the layout and scale of your installation, you may have multiple VMware provisioned licenses.

You can subsequently create any number of subkeys from any VMware provisioned license. Each subkey is used to add a Sensor to your installation. They are also referred to as sensor licenses. The subkey always belongs to a specific license.

The Licensing page consists of the following tabs:

  • Licenses tab View a list of all licenses for this installation.

  • License information tab View and modify the current license information.

  • Sensors tab View and modify all the available subkey licenses. You can also create a subkey license.

  • Sensor groups tab View, create, and modify sensor groups.

View licenses

The Licenses tab displays all the licenses associated to this installation. The list includes the following fields:

  • License key The unique identifier for the license.

  • Product The product type associated to the license. Products hosted in the NSX Cloud are denoted with a cloud icon.

  • License type The type of license.

  • Installation key Identifies the main license of an On-Premises installation.

  • Start date The date when the license was initialized.

  • Expiration date The date when the license expires.

  1. Navigate to the Licenses tab

    From the Main navigation menu, click Admin. On the Admin page, select Accounts from left sidebar menu. Then on the Licensing page, click the Licenses tab.

  2. Optional: Reset the API token

    Click edit to reset the API token for the license.

    For an On-Premises installation, you need to perform this request on the appliance. You can only reset the API token of secondary licenses. To reset the API token of your main license, contact VMware Support.

  3. View the sensors

    If there are sensors associated with the license, click the server icon or the license key to view the sensors.

Manage sensors

The Sensors tab displays all the available Sensor licenses. A Sensor license consists of a Sensor key, which is a string you create, concatenated to your VMware generated customer License key (for example, ABCDEFGHIJ0123456789:sensor-1). This license structure allows the On-Premises Manager or the VMware backend to quickly and correctly identify the Sensor when it connects.

  1. Navigate to the Sensors tab

    On the Licenses tab, click the server icon or the license key or click the Sensors tab.

  2. Set the sensor status

    By default, a Sensor is set to Active. You can toggle it to Inactive. The system prompts you that toggling an active Sensor to inactive takes effect immediately.

  3. Add a sensor license

    Click the plus icon to create a new Sensor license. On the Add sensor tab, perform the following steps:

    1. Select a license key

      Select a License key from the pull-down menu. For example, ABCDEFGHIJ0123456789.

    2. Enter a sensor key

      Enter a Sensor key. The sensor key is restricted to alpha-numeric characters, dot (.), and dash (-). For example, sensor-1.

      The resulting sensor license is the license key with the sensor key concatenated to it, for example, ABCDEFGHIJ0123456789:sensor-1.

    3. Optional: Enter a name for the sensor

      Enter a Name. The name is restricted to alpha-numeric characters and following special characters: ( ) [ ] - : . , ; _ @ ~ / # % ! | $ ^

    4. Save the license

      Click Save. Click the Sensors tab to return to the Sensors listing and confirm the sensor license has been added.

    After you have added a sensor license, you can install and register a new Sensor. When you are prompted for a license for the Sensor, the lastline_register command will display the sensor license you created in the list of available licenses.

  4. Add or edit a sensor group

    Click edit in the Group column header. The Sensor groups tab is loaded.

About sensor groups

A sensor group is a correlation domain; a mechanism to correlate data from multiple sensors under a single identifying Sensor. All incidents and campaigns belong to the sensor group. The sensor group correlates events from its member sensors into incidents and campaigns. All events are detected by individual sensors and attributed to them. Incidents and campaigns are attributed to the sensor group. Events from sensors that are not part of the sensor group are not combined or correlated (however, they are combined within the sensor, allowing campaigns to be derived).

If a sensor is not part of a sensor group or if an incident was detected before the sensor was configured to be a member of a sensor group, that incident will be attributed to the individual sensor.

Some guidelines and features of sensor groups:

  • A group will only start aggregating new incidents after it is created. This means there won't immediately be any incidents or events for a new group.

  • A group is identified by a sensor. This sensor is the group identifier and is always listed first in the listing of sensors the group contains. It cannot be removed.

  • The group identifier should be an existing sensor, associated with an actual appliance. Select Existing sensor key when you create a group (see below).

  • A group name can only be changed by changing the name of its identifying sensor.

Sensor groups and notifications

The VMware NSX Network Detection and Response can be configured to send notifications to various third party systems. Notifications are triggered by different classes of events.

  • Notifications for network events are sent from the individual sensors. For an On-Premises installation, you can instead configure notifications to be sent from the manager.

  • Notifications for the intrusions are sent from the main sensor for the sensor group.

  • There are no separate notifications for incidents.

All members of a sensor group belong to the same license. You should apply the notification parameters to the license. Alternatively, you must individually configure the notification parameters for each sensor in the sensor group. Using a sensor group to configure notifications for a set of sensors is not supported.

CAUTION:

Under certain circumstances, intrusion notifications may not work correctly:

  1. If notifications are sent from the sensors

  2. The sensors belong to a sensor group

  3. The group identifier is tied to a virtual sensor or to a sensor that is currently not running

The workaround is to ensure the group identifier source is an existing physical sensor.

Manage sensor groups

Manage your sensor groups on the Sensor groups tab.

  1. Navigate to the Sensors groups tab

    On the Sensors tab, click edit in the Group column header or click the Sensor groups tab.

  2. Add a sensor group

    To create a new sensor group in the Add group section, perform the following steps

    1. Select the group identifier source

      Using the buttons, select the Group identifier source. Your choice is New sensor key or Existing sensor key. The recommendation is that you use an existing sensor key.

    2. Select a license

      Select a License key from the pull-down menu.

    3. Select a sensor

      Select a Sensor from the pull-down menu.

      The License key, Sensor key, and Sensor name are displayed below the menus.

    4. Save the sensor group

      Click Create group from existing sensor to save the sensor group.

  3. Add sensors to the group

    Click plus to expand the Sensor groups list. In the Add sensor to group section, select a Sensor from the pull-down menu. The block below the menu displays the sensor parameters.

    Click plus Add sensor to group.

  4. Optional: Remove a sensor from the group

    To remove a sensor, click the delete Remove sensor button. Then click the delete Confirm remove sensor button.

Manage appliances

Use the tabs on the Admin Appliances page to manage the appliances of your VMware NSX Network Detection and Response installation. You can view an overview of the active appliances, inspect the configuration of a selected appliance and make changes, and view the logs and other metrics for all appliances or a specified appliance.

For a On-Premises environment, you will have at least one Manager, as well as Data Node, Engine, and Sensor appliances.

For a Hosted environment, you will have one or more Sensor appliances to manage.

The Appliances page consists of the following tabs:

  • Overview tab View a map showing the locations of all the appliances in this installation. This tab also displays a listing with information about each of the appliances.

  • Status tab View the current status of a selected appliance.

  • Configuration tab Modify the configuration settings of a selected appliance.

  • Action logs tab View status changes made to the selected appliance.

  • Monitoring logs tab View the monitoring logs from the selected appliance or appliances.

  • Metrics tab View performance metrics of the User Portal and the various appliances.

View appliances

The Overview tab displays the locations of the active appliances in your VMware NSX Network Detection and Response installation on a map. It also displays a listing with information about the appliances.