Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

ML VM (Threat Hunting) Deployment

Overview​

Threat Hunting is a machine learning-based anomaly detection add-on. It requires a dedicated Machine Learning (ML) VM, deployed alongside — but separate from — the ECA cluster, to run the anomaly-detection models against the same audit event stream the ECA already processes. Threat Hunting is included in your subscription license for Data Security Edition — no separate license is required, your data does not leave your on-premises environment, and it will show up in the menu once installed.

Sizing for the ML VM scales with the size of your ECA cluster — see Design Guide — Threat Hunting Machine Learning VM Sizing for the full table. This page covers what's specific to the ML VM itself: platform support, minimum hardware/software requirements, and the configuration details you need to gather before installing it.

Platform Support​

Important

The Threat Hunting module is currently distributed as an OVA package and is supported only on VMware-based virtualization platforms. Support for additional hypervisors is planned for a future release.

Minimum Requirements​

  • CPU: 8 cores minimum
  • RAM: 48 GB minimum
  • Storage: 300 GB minimum

These are the minimum specifications for smaller environments (3 or 6 ECA nodes). For larger ECA clusters (9 or more nodes), the ML VM requires more resources — see the full sizing table in the Design Guide.

Software Prerequisites​

  • Operating system: OpenSUSE Linux. Deploy the OVA named Superna Kubernetes OVF (latest version) from the Superna Support Portal.
  • Eyeglass: Version 2.14.1 or higher, with an ECA cluster already configured.
  • Administrative access: Root/sudo privileges on the installation server.

This 2.15.0 release satisfies the Eyeglass version minimum above (2.15.0 is higher than 2.14.1).

Required Configuration Details​

Before starting installation, gather the following from each relevant VM:

On the Threat Hunting VM:

InformationHow to obtain
ML module IP address and portRun ip addr show for the IP address; the port is specified during installation.

On ECA node 1:

InformationHow to obtain
ECA node IP addressesRun ecactl cluster exec hostname -I to list all node IPs.
Kafka connection infoRun ecactl cluster exec docker exec kafka cat ./config/server.properties | grep listeners= on the ECA master node.

On the Eyeglass/SCA VM:

InformationHow to obtain
Eyeglass server IPRun hostname -I on the Eyeglass VM.
Appliance IDDisplayed directly in Inventory → License Management (with a Copy Appliance ID button), or run igls admin appid on the Eyeglass server.

Download Requirements​

Download the Threat Hunting installer (latest version) from the Superna Support Portal, in addition to the Superna Kubernetes OVF referenced above.

See also​