Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Storage Platform Agent Configuration

Introduction​

Before the Eyeglass Clustered Agent (ECA) cluster can detect threats, it needs a stream of audit events from your storage platform. This page covers the PowerScale OneFS audit configuration you perform on the storage platform itself to enable auditing and expose audit data to the ECA. It does not cover deploying the ECA VMs themselves; for that, see Eyeglass, ECA, and Mini-ECA Installation. For the equivalent Dell ECS steps — adding an ECS cluster to Eyeglass inventory, licensing, and Security Guard on ECS — see Dell ECS Configuration.

info

Complete these steps after the storage platform prerequisites in Pre-Requisites have been reviewed, and before or during ECA cluster deployment.

PowerScale OneFS Configuration​

Enable protocol and configuration change auditing​

The audit protocol is enabled per Access Zone. Any zone that does not have auditing enabled is unprotected — enable it on every zone you want Data Security to monitor.

  1. Click Cluster Management > Auditing.
  2. In the Settings area, select the Enable Configuration Change Auditing and Enable Protocol Access Auditing checkboxes.
  3. In the Audited Zones area, click Add Zones.
  4. In the Select Access Zones dialog box, select one or more access zones, and click Add Zones. Do not add the Eyeglass access zone.

Disable high-rate audit events (OneFS 8.2 and later — mandatory)​

Directory Open and Directory Close events generate unnecessary load on the cluster and are not used by Data Security. Disabling them is required on OneFS 8.2 and later.

Log in to the OneFS cluster over SSH as the root user and run, for each audited zone:

isi audit settings modify --zone=<zone_name> --remove-audit-success=open_directory,close_directory

This takes effect immediately and reduces audit overhead.

Create a read-only NFS export for audit log delivery​

The ECA cluster reads audit data from PowerScale over NFS. Before creating the export:

  1. Configure a SmartConnect name in the system zone for the export path /ifs/.ifsvar/audit/logs.
  2. Set the PowerScale IP pool used for this export to dynamic allocation mode, so the export remains reachable if a node fails.
  3. NFS v4.x is supported starting with Appliance OS version 15.3 and later; NFS v3 is also supported. Kerberized NFS is not supported.

Create the export from the OneFS CLI:

isi nfs exports create /ifs/.ifsvar --root-clients="<ECA_IP_1>,<ECA_IP_2>,<ECA_IP_3>" --clients="<ECA_IP_1>,<ECA_IP_2>,<ECA_IP_3>" --read-only=true -f --description "Easy Auditor Audit Log Export" --all-dirs true
note

If you enable NFSv4, confirm your ECA nodes' fstab/auto-mount configuration specifies the mount protocol explicitly. Consult Dell before enabling NFSv4 if this is not already the case.

Enable REST API audit ingestion (mandatory for all deployments)​

In addition to the NFS-based export above, REST API audit ingestion is required for all deployments (Superna 2.5.8.1 and later).

  1. On the Eyeglass VM, update the service account role to add backup read permissions:

    # OneFS 9.x
    isi auth roles modify EyeglassAdmin --add-priv-ro ISI_PRIV_IFS_BACKUP

    # OneFS 8.2 and later
    isi auth roles modify EyeglassAdmin --add-priv-ro ISI_PRIV_IFS_BACKUP
    isi auth roles modify EyeglassAdmin --add-priv-ro ISI_PRIV_IFS_RESTORE

  2. On each PowerScale cluster to be protected, log in as the root user and create the following symlink:

    ln -s /ifs/.ifsvar/audit/logs /ifs/auditlogs

  3. On the ECA cluster, set TURBOAUDIT_AUDITLOG_PATH=/ifs/auditlogs in eca-env-common.conf and cycle the cluster (ecactl cluster down / ecactl cluster up) for the change to take effect. See Eyeglass, ECA, and Mini-ECA Installation for the full procedure.

Firewall

REST API audit ingestion requires HTTPS TCP 8080 open from each ECA node to every PowerScale node in the management pool. NFS-based ingestion requires the applicable NFS ports (v3: TCP/UDP 111, 2049, 300; v4.x: TCP 2049) open from the ECA cluster to the storage platform. See Firewall Configurations for the complete port matrix, including ports required for Threat Hunting, Mini-ECA, and AirGap.

NTP​

Verify all PowerScale clusters being monitored are synchronized to an NTP server. Time synchronization between the storage platform, Eyeglass, and the ECA cluster is required for correct event correlation.

Roles and permissions​

Role/AccountPurpose
RANSOMWARE_DEFENDERView and configure Ransomware Defender.
RANSOMWARE_READONLYRead-only view of Ransomware Defender.
EyeglassAdmin (OneFS role)Requires ISI_PRIV_IFS_BACKUP (and ISI_PRIV_IFS_RESTORE on 8.2+) for REST API audit ingestion, as shown above.

Assign these through the User Roles page, which also links to the full Eyeglass RBAC setup procedure. Licensing for each writable PowerScale cluster (agent license and agent maintenance) is covered in Pre-Requisites — Licensing.

Analytics database (Easy Auditor only)

If you are also licensed for Easy Auditor, an additional HDFS-backed analytics database access zone must be configured on PowerScale (dedicated access zone, IP pool, HDFS license, and a local eyeglasshdfs user). This is not required for Data Security deployments on their own. See Eyeglass, ECA, and Mini-ECA Installation — Preparation of Analytics Database or Index if Easy Auditor is licensed.

See also​