Deployment Options

[#1]

There are two types of deployment options:

• NetWitness SASE Automated Deployment

• NetWitness SASE Manual Deployment

Additional NetWitness SASE deployment configurations are available, offering different levels of automation and network packet ingestion rates.

NetWitness SASE Automated Deployment

NetWitness has developed an data-driven automated deployment capability specific for NetWitness SASE based integrations. The NetWitness SASE Automated Deployment is currently only supported on the Google Cloud Provider (GCP) Cloud environment.

This NetWitness deployment capability utilizes a script based approach from an on-prem NetWitness Admin-Server to the customer’s specified GCP Project. The NetWitness SASE Deployment capability utilizing a customer provided service account, automates the deployment of NetWitness SASE components such as Decoders/Concentrators instances, and the supporting cloud native infrastructure such as the networks and sub-networks, gateways, firewalls, etc. The deployment additional supports the attachment of configurable attached drive specifications based on ingest rate expectations. Refer SASE Node-x (Decoder/Concentrator) - GCP Persistent Disk (PD) Storage Configuration Section of the NetWitness Storage Guide for information on setting up cloud storage including sizing configurations.

Additionally, the NetWitness SASE Automated Deployment includes a secure overlay network that isolates and encrypts all NetWitness SASE based communication without requiring complicated VPN/Firewall configuration between the customer’s on-prem Admin-Server and the NetWitness cloud based assets. For more information on SASE Automated Deployment, refer to SASE Hybrid Cloud Installation Guide. While the NetWitness SASE Deployment capability provides substantial automated configuration support and simplicity, the convenience must be balanced with the customer’s desire for granular deployment control into their cloud project.

NetWitness SASE Manual Deployment

This deployment approach will not include the SASE Overlay network, and therefore communication between NetWitness Components will need to be enabled based on the NetWitness services and nodes included in the NetWitness SASE implementation. Refer Network Architecture and Ports  for port architecture details. This approach is the most flexible but configuration intensive.

Refer Prepare Virtual or Cloud Storage Section of the NetWitness Storage Guide for information on the manual addition and configuration of external storage for the NetWitness nodes. The sizing of the attached storage required for SASE Cloud based Decoders and Concentrators can be derived from the SASE Node-x (Decoder/Concentrator) - GCP Persistent Disk (PD) Storage Configuration Section of the NetWitness Storage Guide. Although that section is specific to sizing external storage for NetWitness Decoders and Concentrators in the GCP Cloud Environment, the sizing principles are conceptually the same for other Cloud Provider manual deployments of Decoders and Concentrators.