Skip Navigation
  1. BlackBerry Docs
  2. CylanceMDR
  3. Third-party Log Source Integration Guide
  4. Installing a Modular Sensor
  5. Install a Modular Sensor in Hyper-V

Install a Modular Sensor in
Hyper-V

When you install a modular sensor in a
Hyper-V
 environment, you need to create a virtual switch with a physical network interface that supports promiscuous mode. Promiscuous mode allows the sensor to monitor all traffic. During the setup, you will specify the number of cores, the amount of memory, and disable processor compatibility mode.
  1. In the
    Hyper-V
     manager, in the right pane, click
    Virtual Switch Manager
    .
  2. In the left pane, under the
    Virtual Switches
     section, click
    New virtual network switch
    .
  3. Select
    External
    .
  4. Click
    Create Virtual Switch
    .
    A switch is created and listed in the Virtual Switches section.
  5. In the left pane, under the
    Virtual Switches
     section, select the switch that was created in the previous step.
  6. Type a name for the switch and make note of it.
  7. In the
    Connection Type
     section, select
    External network
     and the appropriate network interface to connect to external networks.
  8. Click
    OK
    .
  9. Open
    Windows PowerShell
     and use the following commands to set promiscuous mode.
    • $a = Get-VMSystemSwitchExtensionPortFeature -FeatureId 776e0ba7-94a1-41c8-8f28-951f524251b5
    • $a.SettingData.MonitorMode = 2
    • add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName
      <name of the switch>
       -VMSwitchExtensionFeature $a
    Replace
    <name of the switch>
     with the name you set in the previous step.
  10. In the
    Hyper-V
     manager, in the
    Action
     menu, click
    New > Virtual Machine
    .
  11. Specify a name for the new sensor. It is recommended to use a site naming convention so that the type of sensor can be easily identified by its name.
  12. Click Next.
  13. Select
    Generation 1
     for the generation type. The guest operating system is a 64-bit OS, so you can select "Generation 1".
  14. Specify the amount of memory (in megabytes) to assign to the VM.
    It is recommended that you assign at least 1.5 times the number of CPU cores for the memory in gigabytes. For example, if you plan to use 8 virtual cores, assign 12 GB of RAM (8 * 1.5 = 12). You can adjust the number of cores at a later step.
  15. Configure the Management network interface. You can either enter a static IP or configure using a DHCP server. This is the interface that will be used for the sensor to send its Interflow data records to the data processor.S
  16. Select
    Use an existing virtual hard disk
     to attach the virtual disk image that you downloaded. You need to specify its location.
  17. Click
    Finish
    .
    In the
    Hyper-V
     manager, the virtual machine that you created is listed.
  18. Select the virtual machine in the list.
  19. In the right pane, click
    Settings
    .
  20. In the left pane, click
    Processor
    .
  21. Specify the number of virtual cores for this VM.
  22. Click
    Apply
    .
  23. In the left pane, expand the processor entry and select
    Compatibility
    .
  24. Ensure that the
    Migrate to a physical computer with a different processor version
     option is disabled.
  25. Click
    OK
    .
  26. Do the following to set a static IP address for the Modular Sensor and apply the token to associate it with
    CylanceMDR
    :
    1. Open the VM for your Modular Sensor. A command line appears.
    2. Enter your login information. The default username/password is aella/changeme. You are prompted to change the password immediately.
    3. Set a static IP address for the modular sensor using the following commands:
      • set interface management ip <ip_address>
      • set interface management gateway <gateway_ip_address>
      • set interface management dns <dns_ip_address>
    4. Enter
      set token string <token>
      , where
      <token>
       is the token provided by the
      CylanceMDR
       onboarding team.
      The message "Sensor token is successfully set" appears.
  • To verify the connection with
    CylanceMDR
     use the following commands:
    • show interface
    • show cm
    • show version
  • The
    CylanceMDR
     onboarding team completes the configuration for your
    CylanceMDR
     tenant to receive logs from your Modular Sensor.