Data Security Bundle Installation Service

Overview

This service is designed for customers who have purchased the Security Bundle and need installation and configuration assistance deploying Ransomware Defender, Easy Auditor and Security Integrations.

Dell SKU: AD154078. Superna Product Code: eyeglass-P028-INS

Service Delivery: Remote sessions for audio, video and screen sharing via Zoom, VPN or alternate remote access to customers' PowerScale equipment. Estimated three (3) hours over a span of 1-2 days with dedicated customer technical resources.
Service scope covers a single clustered ECA agent installation and configuration, with up to 2 collocated PowerScale Clusters.
Operating Hours: Monday to Friday 9 am - 4 pm in your local time zone excluding major holidays.
Terms and Conditions:
- Legacy EULA: https://manuals.supernaeyeglass.com/project-eula-and-support-agreement/HTML/supernaeyeglasseulaandsupportservicesagreemen.html
- Subscription EULA: https://manuals.supernaeyeglass.com/project-eula-and-support-agreement/HTML/superna-subscription-terms-and-conditions.html

Exclusions:

Superna resources are not authorized to provide design recommendations for Disaster Recovery features. This would require a purchase of the DR Design and Implementation Service
Hands-on changes to external IT components, for example DNS, Active Directory, PowerScale or other non Superna supplied products.
Service delivery requires customers to have hands-on knowledge of all external IT components.

Prerequisites

Complete these steps prior to scheduled installation and configuration:

Complete a Pre-Installation Questionnaire Form located here
Send a schedule installation request to services@superna.net
Core Agent Appliance is installed
Run an event rate script to determine a number of VMs
On the day of installation confirm availability of the DNS administrator to make changes if the above steps require debugging or were misconfigured.
Firewall ports opened as per documentation for ECA clusters

Service Methodology Flow

Initial Setup and ECA (Extended Cluster Agent) Installation and Configuration Service

ECA Agent Installation Phase - Remote installation with customer to accomplish the following:

Prerequisite - Gather and review site installation data submitted from the questionnaire

Configuration Phase - Remote

Apply License
Edit configuration file on agent startup
Startup clustered agent code
Configure PowerScale to audit files for testing phase
Verify audit messages are being processed
Completed

Ransomware Defender Configuration Phase:

Configuration and Testing:

Configure Security Guard feature
- Validate successful execution
- Configure schedule
- Knowledge transfer on log file validation for Security guard
Enable monitor mode to baseline user behavior
Review Security assessment on enforcement section in the admin guide
Schedule follow on Health Check and Knowledge Transfer sessions two-three weeks from phase completion

Knowledge Transfer:

How to enable production mode
Operational cluster management section
How to process security incidents work flow from the admin guide: How to respond to Security Events for Warning, Major or Critical Events
How and when to make white list changes when introducing new server applications that write data to PowerScale
UI walk through

Easy Auditor Configuration Phase:

Configuration and Testing:

Verify audit data is being stored in the analytics database with query interface
Run test user query report
Run test path based report
Test Where did my folder go?
Review test wiretap functionality on a path with a test user mounting and accessing files

Knowledge Transfer Phase

How to build a query and filter on user, path, file extension, file action
How to run query reports
Where to read documentation on Easy Auditor Operations.
Cluster Operations

Service complete - Review and deliver final ECA Installation Report.

Search Section:

This only applies if the service was purchased with Search & Recover.

Configuration Phase - Search

Download: The OVA can be downloaded by following the normal download instructions here.
1. The menu item to select is VMware OVF installers and select the Eyeglass Search & Recover download
Deploy to vCenter: During deployment to VMware enter the IP address information for each node, Enter cluster name all lowercase with no special characters.
Add License keys:
1. Download keys using supplied token in process here.
2. Copy the license zip file to node 1 using SCP or Winscp utility to copy the zip file using Secure Shell protocol, login with ecaadmin and password above
Apply License keys:
1. Follow add license keys CLI instructions section "Licensing CLI Commands " in the Admin Guide.
Add cluster:
1. Follow add cluster CLI instructions section "Adding, Viewing Clusters " in the Admin Guide.
Add Path to be indexed:
1. Follow the instructions to add a folder for indexing in the section "How to add a folder path to be Indexed" in the Admin Guide.
Start Indexing Jobs:
1. Follow the instructions to start indexing job in the section "How to start a full index job on a path" in the Admin Guide.
Monitor Indexing Statistics:
1. Follow the instructions to monitor indexing progress of the folder path added above in the section "How to Monitor Index Jobs" in the Admin Guide.

Test Phase - Search & Recover

Login and try some searches:
1. open a browser https://x.x.x.x (ip is node 1 of the cluster)
2. Enter an AD user login using DOMAIN\user or user@example.com (note domain name must be uppercase) and then password.
3. Try a search for data in the path you indexed.
4. NOTE: The user you login must have Share permissions to the path was added to be indexed data
Advanced Feature Walk though
1. Try a file size range search
2. Download the results to CSV
3. Download a script with example ISI command isi get -D and output to a results file >> results.txt

Knowledge Transfer Phase - Search & Recover
1. Explain Solutions available with the product. Guide here.
2. Explain how to use the diagnostic tools and how to access. Guide here.
3. Explain index process for full versus incremental and lag to detect changed files.
4. Demonstrate how to generate a support backup and how to download from the admin download page Guide here.
5. Explain how to download CSV and large scripts from the admin download page. Guide here.
6. Explain how to set the results location FQDN for smartconnect and how SMB share names are inserted dynamically. Guide here.
7. Explain where to find advanced field search syntax examples and search rules with wild cards. Guide here.
8. Explain the security modes on indexed folders, guide Here.

Golden Copy Section

This only applies if the service was purchased with Golden Copy.

Configuration Phase - Golden Copy

Download: The OVA can be downloaded by following the normal download instructions here.
1. The menu item to select is VMware OVF installers and select the Eyeglass Golden Copy download
Deploy to vCenter: During deployment to VMware enter the IP address information for each node, Enter cluster name all lowercase with no special characters.
Add License keys:
1. Download keys using supplied token in process here.
2. Copy the license zip file to node 1 using SCP or Winscp utility to copy the zip file using Secure Shell protocol, login with ecaadmin and password above
Apply License keys:
1. Follow add license keys CLI instructions section "Licensing CLI Commands " in the Admin Guide.
Add cluster:
1. Follow add cluster CLI instructions section "Adding, Viewing Clusters " in the Admin Guide .
Add Path to be copied:
1. Follow the instructions to add a folder for archiving in the section "How to manage folders to be copied or synced" in the Admin Guide .
Start Archiving Jobs:
1. Follow the instructions to start indexing job in the section "archive (start a copy job)" in the Admin Guide .
Monitor Archive jobs:
1. Follow the instructions to monitor indexing progress of the folder path added above in the section "How to monitor copy job performance and job log" in the Admin Guide .
Verify Copy Jobs and How to Review reports:
1. Review summary copy reports
2. Review detailed copy reports

Test Phase - Golden Copy

Login and try monitor copy reports:
1. open a browser https://x.x.x.x (ip is node 1 of the cluster)
2. eccaadmin and password
3. Start a file copy, monitor the copy, review copy logs
Advanced Feature Walk though
1. How to configure folders for S3 storage types (add, modify , delete)
2. Walk through folder flags and meaning of how to configure features

Knowledge Transfer Phase - Golden Copy
1. Explain best practices and when to use copy, vs sync mode
2. Explain use cases for deferred delete, Airgap
3. Explain single file restore
4. Explain bulk restore and commands
5. Explain rate limiting options for bandwidth
6. Explain concurrent file copy settings and impact of increasing
7. Explain PowerScale node use case
8. Explain load balancing copies to target storage

Performance Auditor Section

This only applies if the service was purchased with Performance Auditor.

Configuration Phase - Performance Auditor

Enable the EVTreporter service on the ECA cluster
Increase RAM on ECA nodes as per sizing table here.
Verify Eyeglass open ports for the Performance Auditor application table is here.
Verify Turbo audit events are being processed by EVT reporter container
Verify cluster audit events are enabled to support the Performance Auditor features here.

Test Phase - Performance Auditor

Open the Performance Auditor application and verify the display is showing analysis data
Switch views to verify all metrics are reported including AD user names

Knowledge Transfer Phase - Performance Auditor
1. Explain top 5 per category display and view switching
2. Explain drill in to an object in each view and how this is used to identify who, what user , what files or application is generating the most work load per node or cluster wide
3. Explain yellow band display is baseline computed from all nodes in the cluster as 2 standard deviations above and below cluster wide average and how to use this baseline to track which nodes are above average load level (same applies to all the other views)
4. Explain application read and write mode tracks SMB or NFS application requests per second as a way to understand relative application efficiency for NAS operations.
5. Demonstrate pinning feature to add a user to the display that is not in the top 5, explain who pinning allows comparison of an object outside the top 5. Demonstrate file extension pinning to monitor an applications impact on cluster resources.
6. Demonstrate how to switch rate from MB's to GB's or KB's depending on the throughput rates of the monitored object.

Data Security Essentials Upgrade Service Scope

Prerequisites

Must be completed before scheduling the upgrade. Estimated time to complete 4 hours.

Windows Server OS > 2019
1. 4 x cpu
2. 32 GB or more of ram
Microsoft SQL Database
1. Remotely hosted or installed co-resident
2. Versions 2019 or later
Install IIS Web server component on Windows Server OS

Scope

Validate SQL database access service account access and firewall ports to reach SQL server database
Run Data Security Essentials (documentation)
Verify upgrade
Verify previous configuration and policies are present
Verify license key
Install new license key
Configure auditing data collection for testing of ingestion and reporting
1. Select a path or SMB share to collect audit data
2. Create IO in this path
3. Verify audit data ingestion
4. Verify reports execute
Knowledge transfer on new features
1. Ransomware policy enable steps for banned file list and response action
  1. Test banned file response on a test user on the test path or smb share
2. Ransomware Behavior detection enable steps
3. Custom behavior policy creation walk through.