CyberHub Deployment Guide for Azure Environment (Global)

This deployment guide will help Accenture Adaptive MxDR customers to build CyberHub using Azure deployment.

The document includes the following topics:

• Introduction to the Accenture CyberHub

• Getting Started

• CyberHub Onboarding Process

• Prerequisites

• Configuration for Azure Environment

Introduction to the Accenture CyberHub

The Accenture CyberHub is designed to collect, compress, and transmit your devices log data securely to the Google Log forwarder for analysis and storage.

Open

Getting Started

The CyberHub is mainly focused on supporting wide range of secure services for customer devices. Devices logs can be processed and analyzed in CyberHub and gathered data can securely transported.

Data collection

1. Security event sources detect and log network and endpoints activity.

2. Log data is gathered by Event Collectors and sent to an Event Translator Service. Event Collectors gathers, filter, and aggregate the log data and send both raw and processed log data to the Event Translator Service for transmission to the CyberHub.

3. A data forwarding service or Google Log Forwarder sends raw / processed security data directly to Chronicle SIEM. The security data is encrypted while in transit to Chronicle.

CyberHub Onboarding Process

Onboarding is the act of configuring, establishing, and validating the flow of data from your devices into the Adaptive MxDR. All devices must be onboarded prior to the Adaptive MxDR being able to utilize data from the device. The CyberHub onboarding process is as follows:

1. The image of an Azure CyberHub is in the form of a Virtual Hard Disk (VHD) which will be transferred to customer Azure storage Account.

2. Connectivity needs to be established for the CyberHub to access all required services.

3. CyberHub virtual hardware requirements need to be in place, as specified in the prerequisites section.

4. CyberHub needs to be deployed by following the deployment instructions.

5. Your Accenture SDL need to be informed about every new deployed CyberHub .

6. CyberHub connectivity details such as Internal IP, hostname and DNS details need to be shared via CyberHub Techstack created on the Adaptive MxDR Portal.

7. Accenture MxDR will be performing CyberHub connectivity tests and review deployment success.

8. After the CyberHub is fully deployed, Accenture MxDR will perform CyberHub baseline and apply hardening scripts. From this point only certified Accenture MxDR Technical resources will be able to access and solely manage the CyberHub.

Assumptions​: Accenture Adaptive MxDR customers provide virtual hardware resources to deploy the CyberHub in on-prem private or public clouds. Customer is responsible for managing the underlying virtual platform. Virtual hardware requirements must be met as listed in Prerequisites. CyberHub deployment also requires customers to make sure all network configuration is in place prior to beginning the installation.

The following information is required for each CyberHub :

Table - 1.1: Installation Requirements

Prerequisites

Before installing the CyberHub, please make sure the following prerequisites are met.

• CyberHub can connect from SOC using the AWS Session Manager. Please discuss this subject with your Technical Project Manager for more queries.

• Virtual hardware is provisioned, as per specification listed below and can support the CyberHub OS base. CyberHub image is currently based on Ubuntu 20.4 version.

• CyberHub requires to have access to the DNS server holding DNS A-records of all event sources planned to be integrated with the MDR service. We can integrate up to 3 DNS servers and 6 DNS. Search Domains per the CyberHub. DNS information is currently not shared between CyberHub's.

• When standing up an CyberHub server to connect to the MDR, apply the following port settings:

Table - 1.2 : Port Requirements

Installation Requirements

Table - 1.3: Minimum System Requirements

CyberHub has minimum 8x8 combination but all available (General Purpose and Memory Optimized) Azure VM size comes with 8 Core start with 32 GiB memory.

CyberHub Azure VM Size

Configuration for Azure Environment

To enable log collection for Azure environment, follow the steps below:

• Obtain the Azure CyberHub image (VHD) file from Accenture Adaptive MxDR.

• Azure Storage Setup for VHD

• Create a virtual network for the CyberHub

• Create a Public IP address for the CyberHub (Optional)

• Create a network security group

• Create a Managed disk for the CyberHub VHD

• Create CyberHub VM from above created managed disk

Obtain the Azure CyberHub image (VHD) file from Accenture Adaptive MxDR.

1. The installation disk image of an Azure CyberHub is in the form of a Virtual Hard Disk (VHD). To transfer the CyberHub VHD file to customer Azure storage, MDR requires either one of the set of following information:

   1. Azure Storage Account Name and Storage Access Key

   2. Blob Name and SAS URL

2. In a web browser, open the Microsoft Azure portal and login with your Azure account credentials.

3. Create a new Resource groups. If you would like to deploy the CyberHub under an existing resource group then you can skip the below steps.

Open

Azure Storage Setup for VHD

Create a Storage account. If you would like to deploy the CyberHub under an existing storage account, then you can skip the below steps.

1. Navigate to Resource > Search Storage account > select Create.   

2. Select correct subscription and resources group

3. Provide appropriate Storage account name and Region.

4. Add Instance Details

• Select Performance as Standard or Premium

• Select Redundancy as Geo-redundant storage (GRS)

• Enable the checkbox for read access to data available 

5. Navigate to next page > Advanced

• Configure security settings

• Configure Blob storage

6. Navigate to next page > Networking

• Configure Network connectivity method and routing

7. Navigate to next page > Tags

• Define appropriate tags.

8. Review all configuration and select Create.

9. Search for above created storage on the search bar and navigate to this created storage account.

10. Navigate to Data Storage > Containers and select New container

11. Provide appropriate container name and set Public access level as Container

12. Review and select Create.

Create a virtual network for the CyberHub

Create a Virtual network account. If you would like to deploy the CyberHub under an existing network account , then you can skip the below steps.

1. Create a resource > Search Virtual network > Select Create

2. On the Create virtual network page, fill the following information.

• In Name, type a name for your virtual network. 

• In Resource group, select Use existing and then select the resource group name, which you created in Step 3.

• In Location / Region, select the same location which was used while creating the resource group name and click Create.

• In Address space, assign the space you would like to use for the CyberHub.

• In Subnet name, type a subnet name.

• In Subnet address range, assign the subnet address range you would like to use for the CyberHub.

• In Subscription, select your subscription.

Create a Public IP address for the CyberHub (Optional)

1. Create a Resource > search Public IP address > select Create

1. In Create public IP address, fill the following information.

Create a network security group

1. Create a Resource > search Network security group > select Create

2. In the Create network security group, fill the following information.

• In Subscription, select your subscription.

• In Resource group, select Use existing and then select the resource group name, which you created in Step 3.

• In Instance details, in the Name field, type a network security group name.

• In Location / Region, select the same location which was used while creating the resource group name.

• Search for the Resource group and select the resource group name which you created in Step 3.

• After you select the resource group name you will see the network security group which was created in Step 1. 

3. In Network security group, click Outbound security rules and then click Add.

On the Add outbound security rule page, fill the required information.

3. Repeat the above steps to allow outbound access for the rest of the below SOC IP addresses.

4. After adding all above SOC IP addresses, you will obtain a similar output as shown below.  

Example: Allow outbound access to Database IP address and port/protocol from the CyberHub.

Create a Managed disk for the CyberHub VHD

1. Navigate a resource > search Managed Disk > select Create.       

2. Select correct Subscription and Resources group.

3. Provide appropriate disk name. This disk will be used later to create CyberHub VM.

4. Select region and availability zone if needed.

5. Select source type Storage blob and browse source blob field to select storage container where you have stored CyberHub 4.0 vhd.

6. Select OS Type as Linux and VM generation as Gen1. Select Premium SSD 256 GiB (Default Performance Tier) as minimum recommended disk size. Please refer for Pre-requisites.

7. Navigate to the next page > Encryption and select Encryption type > (Default)

8. Navigate to the next page > Networking and choose appropriate connectivity method.

9. Navigate to the next page > Advanced and select enabled shared disk as No.

10. Navigate to the next page > Tags

11.Please define appropriate tags for VM.

12. Review all configuration and select create.

Create CyberHub VM from above created managed disk

1. Search for Disks on the search bar and navigate to the managed disk created in Step 1.

2. Select Disk and navigate to Overview page. Disk will be in unattached state.

3. Select Create VM option from Overview page.

4. Select correct subscription and resources group.

5. Provide appropriate virtual machine name for CyberHub VM.

6. Region will be pre-populated.

7. Select Availability options as No redundancy required.5

8. Image option will be pre-populated and it will be selected to CyberHub managed disk created in Step 1.

9. Uncheck Azure spot instance.

10. Selected correct VM size. Recommended is E-Series Memory Optimised Family type with minimum 32 Memory and 8 CPUs. Please refer prerequisites.

11. Select Public inbound ports > None and License type > Other.

12. Navigate to next page > Disks

13. Navigate to next page > Networking.

This will setup Network Interface for VM

• Please select appropriate Virtual network, Subnet, Public IP, NIC network security group, Public inbound ports

• Please choose Advanced option under NIC network security group and configure security group created in above steps.

14. Navigate to next page > Management.

15. This will configure monitor options for VM.

• Set Boot Diagnostics as managed storage account

• Uncheck the OS guest diagnostics

• Uncheck the System Managed identity

• Uncheck the Login with Azure AD

• Uncheck auto shutdown

• Set Patch orchestration option as Image default.

16. Skip Navigate to next page > Advanced. We don't provide custom and user data to VM.

17. Review all details and select Create.

If you want to change private IP assignment to static or to specific private IP, use following steps:

1. Select Networking in Settings of CyberHub VM.

2. In Networking, select the name of the primary network interface next to Network interface.

3. In the network interface properties, select IP configurations in Settings.

4. Select ipconfig1 (config to which Private IP assigned) in the IP configurations page

5. Navigate to Private IP address settings, change assignment to Static, provide private IP or retain same IP and Click Save.

6. To move forward with the onboarding process, please notify the Accenture Adaptive MxDR team once you have completed the steps outlined above.