Azure Installation Overview

Azure instances have the same functionality as the NetWitness hardware and virtual hosts. NetWitness recommends that you perform the following tasks when you set up your Azure environment.

Before you can deploy NetWitness in Azure, you need to:

  • Review the recommended compute and memory specifications needed for each NetWitness instance.

  • Get familiar with the NetWitness Storage Guide to understand the types of drives and volumes needed to support NetWitness instances. For more information, see Storage Guide for NetWitness® Platform 12.5.
  • Make sure that you have a NetWitness Throughput license.
  • Use Chrome for your browser (Internet Explorer is not supported).

Azure Environment Recommendations

Azure instances have the same functionality as the NetWitness hardware hosts. NetWitness recommends that you perform the following tasks when you set up your Azure environment.

  • Based on the resource requirements of the different components, follow best practices to use the system and dedicated storage appropriately.
  • Build Concentrator directory for index database and Decoder directory for Packet database on SSD Disks with high IOPS / write throughput.

Azure Upgrade Recommendations

In-place upgrades on Azure VMs are supported when followed by the Standard Configuration outlined in this Azure Installation Guide. The user is responsible for ensuring that no VM policies at the Azure Subscription level interfere with the VM's operating system, such as configurations related to the Azure Control Plane.

If you follow the Azure Installation Guide correctly, you should experience a smooth upgrade process without encountering any warnings. However, deviating from these guidelines or adding extra configurations, such as those involving the Azure Control Plane, can lead to errors, as shown below:

Azure_warning.png

Azure Deployment Scenarios

Before you can deploy NetWitness you need to:

  • Consider the requirements of your enterprise and understand the deployment process.
  • Have a high-level picture of the complexity and scope of a NetWitness deployment.

Process

The components and topology of a NetWitness network can vary greatly between installations, and should be carefully planned before the process begins. Initial planning includes:

  • Consideration of site requirements and safety requirements.
  • Review of the network architecture and port usage.
  • Support of group aggregation on Archivers and Concentrators, and virtual hosts.

When updating hosts and services, follow recommended guidelines under the "Running in Mixed Mode" topic in the NetWitness Host and Services Getting Started Guide.

You should also become familiar with Hosts, Host Types, and Services as they are used in the context of NetWitness also described in the NetWitness Host and Services Getting Started Guide.

NetWitness High-Level Deployment Diagram

NetWitness is inherently modular. Whether organizations are looking to deploy on-premise or in the cloud, the NetWitness components are decoupled in a way which allows flexible deployment architectures to satisfy a variety of use cases.

The following figure is an example of a hybrid cloud deployment, where the base of the components are residing within the SecOps VPC. Centralizing these components make management easier while keeping network latency to a minimum.

Network, log and endpoint traffic could then be aggregated up to the SecOps VPC. The on-premise location would function just like a normal physical deployment and would be accessible for investigations and analytics.

Cloud SaaS visibility could be captured from a Log Decoder residing in either the cloud or on-premise locations.

netwitness_hybridcloud.png