exabeam EX2003 User manual

Exabeam Appliance Setup
Guide
Exabeam Security Management Platform - Version SMP 2019
Publication date March 15, 2021
Exabeam
2 Waters Park Dr. Suite 200
San Mateo, CA 94403
650.209.8599
Have feedback on this guide? We'd love to hear from you!
Email us at [e-mail]
Disclaimer: Please ensure you are viewing the most
up-to-date version of this guide
by visiting the Exabeam Community.

Copyright
All content in this document, including text, graphics, logos, icons, images, and video clips, is the
exclusive property of Exabeam or its content suppliers and is protected by U.S. and international
copyright laws. The compilation (meaning the collection, arrangement, and assembly) of all content in
this document is the exclusive property of Exabeam and is also protected by U.S. and international
copyright laws. The content in this document may be used as a resource. Any other use, including the
reproduction, modification, distribution, transmission, republication, display, or performance, of the
content in this document is strictly prohibited.
Copyright ©2021 Exabeam, Inc. All Rights Reserved.
Trademarks
Exabeam, the Exabeam logo, Threat Hunter, Smarter SIEM, Smart Timelines and Security Management
Platform are service marks, trademarks or registered marks of Exabeam, Inc. in the United States and
other countries. All other brand names, product names, or trademarks belong to their respective
owners. The marks and logos displayed in this document may not be used without the prior written
consent of Exabeam or their respective owners.
Patents
Exabeam owns, and reserves all rights for, patents for Exabeam products and services, which may be
protected under registered patents as well as patents pending.
Other Policies
For information regarding Exabeam’s treatment of personally identifiable information, please review
Exabeam’s current privacy policy at www.exabeam.com/privacy.

Table of Contents
1. Set Up The Appliance ............................................................................................................... 5
2. Rack Mounting Instructions ...................................................................................................... 6
2.1. Identify The Sections Of The Rack Rails .......................................................................... 6
2.2. Install The Inner Rails .................................................................................................... 7
2.2.1. Release The Inner Rails ....................................................................................... 7
2.2.2. Install The Inner Rail Extension And Rails ............................................................ 8
2.3. Install Outer And Middle Rails ........................................................................................ 9
3. Install The Exabeam Appliance Chassis Into A Rack ................................................................. 12
4. Connect The Exabeam Appliance Cabling ............................................................................... 14
5. Exabeam Appliance Network Configuration ............................................................................ 15
5.1. Appliance Network Teaming Configuration .................................................................. 18
5.1.1. DHCP Teaming Configuration ........................................................................... 18
5.1.2. Static IP Teaming Configuration ........................................................................ 19
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 4

1. Set Up the Appliance
Follow the steps to set up the physical appliance.
A number of steps are involved in mounting the rack and getting the network and hostname configured
on the EX3000, which is required for Data Lake and the EX2003 and EX4003, which is required for
Advanced Analytics.
Set Up the Appliance
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 5

2. Rack Mounting Instructions
Follow the rack mounting instructions to install the Exabeam appliance chassis into a rack unit.
This section provides information on installing the Exabeam appliance chassis into a rack unit with the
rails provided. There are a variety of rack units on the market, which may mean the assembly procedure
will dier slightly. Please also refer to the installation instructions that came with the rack unit you are
using.
NOTE
EX2003 and EX4003 are 1U rack units. The rail fits a rack between 26" and 33.5" deep.
EX3000 is a 2U rack unit. The rail fits a rack between 26.5" and 36.4" deep
2.1. Identify the Sections of the Rack Rails
The rack rails must be properly identified in order to assemble them in the correct order.
The chassis package includes two rack rail assemblies in the rack mounting kit. Each assembly consists
of three sections:
• an inner fixed chassis rail that secures directly to the server chassis.
NOTE
For EX2003 and EX4003, the inner rails are pre-installed on the chassis.
• an outer fixed rack rail that secures directly to the rack itself.
• a middle rail which extends from the outer rail.
EX2003 and EX4003 inner rails
Rack Mounting Instructions
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 6

EX3003 inner rails
Rail assembly
WARNING
Do not pick up the server with the front handles. They are designed to pull the system from a rack
only.
2.2. Install the Inner Rails
To install the inner rails, you must release the rails then install the rail extension along with the inner
rails.
2.2.1. RELEASE THE INNER RAILS
Each inner rail has a locking latch. This latch prevents the server from coming completely out of the rack
when the chassis is pulled out for servicing.
To mount the rail onto the chassis, first release the inner rail from the outer rails:
1. Pull the inner rail out of the outer rail until it is fully extended as illustrated below.
2. Press the locking tab down to release the inner rail.
Rack Mounting Instructions
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 7

3. Pull the inner rail all the way out.
4. Repeat for the other outer rail.
2.2.2. INSTALL THE INNER RAIL EXTENSION AND RAILS
1. (Optional) Attach the inner rail extension to stabilize the chassis within the rack.
NOTE
The Exabeam appliance chassis includes a set of inner rails in two sections: inner rails and inner
rail extensions. The inner rails are pre-attached and do not interfere with normal use of the
chassis if you decide not to use a server rack.
2. Place one of the inner rail extensions against the side of the chassis, aligning the hooks on the side
of the chassis with the rail extension holes. Ensure the extension faces outward just like the pre-
attached inner rail.
NOTE
The le and right inner rails are symmetrical.
3. Slide the extension forward, toward the front of the chassis.
4. Secure the extension to the chassis with two screws.
5. Repeat steps 1-3 for the other inner rail extension.
Rack Mounting Instructions
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 8

2.3. Install Outer and Middle Rails
Install the outer and middle rails by following the steps for your appliance type before you install the
chassis.
For EX2003 and EX4003
1. Attach the shorter outer rail to the outside of one of the longer outer rails. You must align the pins
with the slide, and both bracket ends must face the same direction.
2. Adjust both the shorter and longer rails to the proper distance by using the sliding adjustment so
that the rail fits snugly into the rack.
3. Clip in, and then secure the long bracket to the front side of the outer rail with two M5 screws, and
the short bracket to the rear side of the outer rail with three M5 screws.
Rack Mounting Instructions
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 9

4. Repeat steps 1-3 for the other outer rail.
For EX3000
1. Press upward on the locking tab at the rear end of the middle rail.
2. Push the middle rail back into the outer rail.
3. Hang the hooks on the front of the outer rail onto the square holes on the front of the rack. The
buttons on the top and bottom of the outer rail push against the tabs, while the hooks go through
the square holes. The outer rail takes up six tabs, starting and ending on a thin tab. If desired, use
screws to secure the front of the outer rails to the rack.
4. Pull out the rear of the outer rail, adjusting the length until it fits within the posts of the rack.
5. Hang the hooks of the rear section of the outer rail onto the square holes on the rear of the rack.
Take care that the proper holes are used so the rails are level. If desired, use screws to secure the
rear of the outer rail to the rear of the rack.
6. Repeat steps 1-5 for the other outer rail.
Rack Mounting Instructions
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 10

Rack Mounting Instructions
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 11

3. Install the Exabeam Appliance Chassis into a Rack
Follow the instructions to securely install the appliance chassis.
We recommend two people working together to install the chassis into the rack in order to avoid
breaking or dropping the chassis.
WARNING
The rack stabilizing mechanism must be in place, or the rack must be bolted to the floor before you
slide the unit out for servicing. Failure to stabilize the rack can cause the rack to tip over.
NOTE
The following figure is for illustrative purposes only. Always install servers to the bottom of a rack first.
1. Confirm that the chassis includes the inner rails and inner rail extensions. Also confirm that the
outer rails are installed on the rack.
2. Align the chassis inner rails with the front of the out rails on the rack.
3. Slide the chassis rails into the rack rails, keeping the pressure even on both sides. You may have to
depress the locking tabs when inserting. When the chassis has been pushed completely into the
rack, you should hear the locking tabs click into the locked position.
4. (Optional) Insert and tighten the thumbscrews that hold the front of the chassis to the rack.
Install the Exabeam Appliance Chassis into a Rack
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 12

Install the Exabeam Appliance Chassis into a Rack
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 13

4. Connect the Exabeam Appliance Cabling
You must connect your appliance cables to the proper ports in order to start configuration.
Before installing an operating system image and Exabeam soware onto your appliance, ensure your
appliance is connected to your network.
1. Connect an ethernet cable to the RJ45 port labeled LAN1 on the back of the appliance.
2. Connect the system to a monitor and keyboard for the initial configuration.
Once the configuration is completed, you can detach the monitor and keyboard.
EX2003 and EX4003 rear view
3. Plug in both power cables to uninterrupted power supply (UPS) or conditioned power sources,
ideally originating from dierent power circuits for each cable.
4. Power up the host to start the boot process.
Connect the Exabeam Appliance Cabling
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 14

5. Exabeam Appliance Network Conguration
Set up the network configuration to install the OS and Exabeam soware.
In order to install the operating system and Exabeam soware on your appliance, it must have its
network presence established. Before configuring the network interface of your host, determine the
address assignment of your host and network details, including:
• IP address
• Subnet
• Network gateway
• DNS addresses
• Use of DHCP or on-board address assignment
WARNING
Exabeam does not support IPv6.
To configure the network interface of your host:
1. Log in to the console with the username exabeam. The unique password for your appliance is
found on a label at the back of the unit.
2. Initiate a screen session. This will prevent accidental termination of your session.
screen -LS [yourname]_[todaysdate]
3. Start the program to configure the network settings by entering the following command on the
command prompt:
sudo nmtui
Use the down, up, and tab keys to move through the program
4. Select Edit a connection, and then press Enter:
5. Select eno1, and then Edit.
Exabeam Appliance Network Conguration
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 15

6. You can a) obtain a static leased DCHP address or b) set the IP address at the host.
NOTE
You must configure a static lease at your DHCP server if you are serving addresses from DCHP.
Otherwise, edit records in the nmtui UI.
a. For a DCHP address assignment:
i. Open the menu next to IPv4 and select Automatic.
ii. Ensure IPv6 is configured as Ignore.
b. For persistent address assignment at the host:
i. Open the menu next to IPv4 and select Manual.
ii. Choose to <Show> the IPv4 details:
iii. Enter the IPv4 Addresses and Gateway.
Exabeam Appliance Network Conguration
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 16

CAUTION
When entering the IP address, the address must be specified in CIDR notation. For
example, if the IP address is 10.10.10.10 with a netmask of 255.255.255.0, the IP
address must be specified as 10.10.10.10/24. Failure to do this will result in an
incorrect subnet mask being assigned.
7. Select OK, and then press Enter.
8. Select Quit, and then press Enter.
9. Restart the network by entering the following command on the command prompt:
Exabeam Appliance Network Conguration
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 17

sudo systemctl restart network
NOTE
NOTE: Once the setup is complete, use the username exabeam. (Please contact Exabeam Technical
Support for the password.)
5.1. Appliance Network Teaming Conguration
NIC teaming consists of aggregating network interfaces on a server. In this scenario, two interfaces share
one published static IP address in your network. Traic is routed to the shared IP and onto the network
device that is active or answering. NIC teaming can be used to increase the network bandwidth available
in a network and provide redundancy to support higher availability. The attributes shown are the
Exabeam supported configurations.
Apply the steps based on the environment your hosts operate with:
• DHCP (with static IP lease), or
• Static IP
5.1.1. DHCP TEAMING CONFIGURATION
Set up a named session to connect to the host and establish administrator credentials. This allows the
process to continue in the event you lose connection to the host.
screen -LS [session_name]
sudo su -
Go to the network configuration directory.
cd /etc/sysconfig/network-scripts/
Backup existing network interface configuration files, for example, to /home/exabeam/. (Do not place
backups into /etc/sysconfig/network-scripts.)
cp ifcfg-eno* /home/exabeam/
Create and bind network interfaces. In this example, the host interfaces eno1 and eno2 are aggregated
to make team0 for the runner state activebackup.
nmcli connection add type team con-name team0 ifname team0 config '{"runner":
{"name": "activebackup"}}'
nmcli connection add type team-slave con-name team0-slave1 ifname eno1 master
team0
nmcli connection add type team-slave con-name team0-slave2 ifname eno2 master
team0
Restart your interfaces. At this point, you may experience 5-10 seconds of unresponsive SSH.
Exabeam Appliance Network Conguration
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 18

ifdown team0;ifup team0
ifdown eno2;ifup eno2
systemctl restart network
Verify that the new state activebackup is configured.
teamdctl team0 state
The status should return that one of interface links is up and the runner's active port is routing to the
interface that is up. The response should resemble:
runner:
active port: eno1
Optionally, verify that your throughput for one interface is up.
teamnl team0 ports
The response should resemble:
eno2: down 0Mbit HD
eno1: up 1000Mbit FD
5.1.2. STATIC IP TEAMING CONFIGURATION
Set up a named session to connect to the host and establish administrator credentials. This allows the
process to continue in the event you lose connection to the host.
screen -LS [session_name]
sudo su -
Go to the network configuration directory.
cd /etc/sysconfig/network-scripts/
Backup existing network interface pointers to, for example, /home/exabeam/. (Do not place backups
into /etc/sysconfig/network-scripts.)
cp ifcfg-eno* /home/exabeam/
Create and bind network interfaces. In this example, the host interfaces eno1 and eno2 are aggregated
to make team0 for the runner state activebackup.
nmcli connection add type team con-name team0 ifname team0 config '{"runner":
{"name": "activebackup”}}' [hostname] [host_ip/CIDR] [gateway_name] [gateway_ip]
nmcli connection add type team-slave con-name team0-slave1 ifname eno1 master
team0
nmcli connection add type team-slave con-name team0-slave2 ifname eno2 master
team0
Restart your interfaces. At this point, you may experience 5-10 seconds of unresponsive SSH.
Exabeam Appliance Network Conguration
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 19

ifdown team0;ifup team0
ifdown eno2;ifup eno2
systemctl restart network
Verify that the new state activebackup is configured.
teamdctl team0 state
The status should return that one of interface links is up and the runner's active port is routing to the
interface that is up. The response should resemble:
runner:
active port: eno1
You can also verify that your throughput for one interface is up.
teamnl team0 ports
The response should resemble:
eno2: down 0Mbit HD
eno1: up 1000Mbit FD
Exabeam Appliance Network Conguration
Exabeam Appliance Setup Guide - Version SMP 2019
Published Mar 15, 2021 20