On-Premises Data Collector

The Secureworks® Taegis™ XDR On-Premises Data Collector enables you to forward various event sources via Syslog for ingestion into the XDR data lake.

Note

When configuring security appliances to forward events via Syslog to a XDR On-Premises Data Collector, ensure that the log format requirements are followed exactly for the supported integration type. If an intermediate log forwarder is being used to forward on behalf of the security appliances, the logs received at the XDR On-Premises Data Collector must meet the log format requirements of the integration type. Logs received by a XDR On-Premises Data Collector that do not adhere to format requirements may be processed as generic events.

Important

With release 1.2.1+, the XDR On-Premises Data Collector has a simplified configuration that requires fewer open ports to operate. If you have a configured collector from an earlier release, it will continue to work. If you want to use the updated collector (release 1.2.1 or better) you need to create and download a new collector from Integrations > Data Collectors in XDR and reconfigure your environment. The instructions below still apply. If you downloaded your generated collector image before December 5, 2019, your collector does not support proxy configuration.

Note

The XDR Collector can support up to 200K EPS (events per second) for properly configured cloud and on-premises collectors.

Note

Third-party tools or applications cannot be installed on any XDR Collector.

Create and Download Your XDR Collector

You can preconfigure, create, and download an On-Premises Data Collector for your environment directly in XDR from Integrations > Data Collectors.

1. From the Taegis Menu, select Integrations → Data Collectors. This page displays the collectors your organization has configured.

2. Select Actions → Add Collector from the top right. The Add Collector modal displays.

   

   Add New Collector

3. Select On-Premises as the collector type and then select Next.

4. Complete the following fields:

   • Name of Collector — A nickname for the collector
   • Description — (Optional) A description of the collector, such as its geographical location or the property name where it resides
   • Hostname — The hostname of the collector
   • Host Proxy — (Optional) Add an HTTP proxy address, using the following format: [http\[s]://\[user:pass@]hostname\[:port]|http://<hostname>[:port]]
   • NTP Servers — (Optional) Specify your own NTP server IP addresses, using the following formats: xxx.xxx.xxx.xxx or xxx://xxxxxxx.xxx

   Tip

   Hit Enter after each NTP server IP address or use a comma , to separate them in the box. Once entered, you can remove an NTP server by selecting the x.

   Note

   Default and custom NTP settings are only used during initial Data Collector setup. Once connectivity is established, the Data Collector synchronizes time via the XDR backend connection.

   • DHCP or Static — Select whether the collector uses DHCP requirements or specify your own static IP requirements.

5. Select Create Collector.

   

   Create Collector

   Tip

   To add the eStreamer app to the collector to retrieve all security event logs from your Cisco Firepower Threat Defense (FTD) device, see eStreamer App. For more information, see the Cisco FTD Firewall guide.

6. The Install Collector modal displays the following files available for download:

   • An .iso that contains the configuration files for your collector.
   • An .ova that is the virtual machine that the collector will run in.
   • A .vhd, which is a .zip collection (downloaded filename is: ctpx-collector.zip) of Microsoft HyperV disk images. This is an alternative to the .ova file.
   • A .qcow2, the virtual disk preferred for Nutanix collectors.

Save these files; you’ll use them during the installation process described below.

Manage Integrations Collector Downloads

Installation

The On-Premises Data Collector is a virtual machine appliance that must be installed in your hypervisor environment in order to collect data and transmit it to the XDR Infrastructure. It can be preconfigured and downloaded in XDR from Integrations > Data Collectors and installed in vsphere, hyperv, or nutanix environments. Once the appropriate information is provided, the collector will be customized, built, and configured to DHCP or static IP addressing depending on your selection.

Note

Recommended virtual environment versions for the XDR On-Premises Data Collector are vSphere ESXi 6.7 or later or Hyper-V 8.0 in Windows Server 2016 or later.

Once complete, an .iso cdrom image containing your client certificate/credentials and disk image in the form of .ova (vsphere) or .vhdx (hyper-v) will be available for download from XDR. You will be required to attach the .iso (cdrom image) to the collector VM on boot.

Once booted the appliance registers with XDR and the status of the connection will be displayed in the XDR Console.

Data Collection and Network Access Requirements

The following is a reference architecture for data collection and provides an overview of the collector’s network access requirements.

Regions

Some configuration specifics of XDR depend on the region you are deployed in (US1, US2, US3, EU).

onPrem

The collector acts by default as a Syslog forwarder and collects security log data. All logs that are sent to the collector will be collected and transmitted using rapid batching to the XDR infrastructure. The collector listens and transmits data on the following ports, and you must allow access from inside your organization to outside on the following hostname and ports.

Note

All Syslog data is forwarded to XDR by way of a secure mTLS connection using TLS 1.3.

Taegis™ XDR Collectors forward Syslog data in batches. The frequency is optimized according to batch size and time since last forward.

Hostname and port configurations are as follows:

Outbound https on Port 443 — TCP

XDR API

• US1— collector.ctpx.secureworks.com
• US2— collector.delta.taegis.secureworks.com
• EU— collector.echo.taegis.secureworks.com
• US3— collector.foxtrot.taegis.secureworks.com

NTP servers: 123/UDP Outbound

The XDR On-Premises Data Collector uses the following standard NTP servers:

• 0.pool.ntp.org
• 1.pool.ntp.org
• 2.pool.ntp.org
• 3.pool.ntp.org

Note

Windows DC servers cannot serve as NTP servers for non-domain hosts such as the On-Premises Data Collector.

Inbound—Syslog

• 514 - UDP
• 601 - TCP

Outbound Device APIs

• 443 - TCP

Connectivity Requirements for Data Collectors

Note

Some configuration specifics of XDR depend on the region you are deployed in (US1, US2, US3, EU).

Any device that uses its own SSL certificate, including Cloud-based and On-Premises Data Collectors, must safelist the following destination IP addresses or domains in order to avoid conflict. If using an AWS data collector, please refer to the AWS table.

For Most Data Collectors

Source	Destination	Port/Protocol	Notes
Data Collector IP or hostname	US1 collector.ctpx.secureworks.com 18.217.45.178/32 3.16.4.173/32 18.224.219.97/32 13.59.146.90/32 3.16.16.254/32 18.223.74.238/32 US2 collector.delta.taegis.secureworks.com 52.14.113.127/32 3.141.73.137/32 3.136.78.106/32 US3 collector.foxtrot.taegis.secureworks.com 44.229.101.49 35.166.77.47 34.214.135.78 EU collector.echo.taegis.secureworks.com 18.158.143.139/32 35.159.14.37/32 52.59.37.234/32	TCP/443	Safelisting device access to XDR
Data Collector IP or hostname	NTP severs IP/Hostnames provided during provisioning	UDP/123	Safelisting device access to NTP servers This rule is only necessary when custom NTP servers are provided during provisioning.
Data Collector IP or hostname	0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org	UDP/123	Safelisting device access to default NTP server. This rule is only necessary when custom NTP servers are not provided during provisioning.
Data Collector IP or hostname	DNS server IPs provided during provisioning	UDP/53 TCP/53	Safelisting device access to DNS servers

Note

If using local NTP, the access must be safelisted both to and from the data collector on those networks.

For AWS Data Collectors

Source	Destination	Port/Protocol	Notes
AWS Data Collector IP or hostname	US1 collector.ctpx.secureworks.com 18.217.45.178/32 3.16.4.173/32 18.224.219.97/32 13.59.146.90/32 3.16.16.254/32 18.223.74.238/32 US2 collector.delta.taegis.secureworks.com 52.14.113.127/32 3.141.73.137/32 3.136.78.106/32 US3 collector.foxtrot.taegis.secureworks.com 44.229.101.49 35.166.77.47 34.214.135.78 EU collector.echo.taegis.secureworks.com 18.158.143.139/32 35.159.14.37/32 52.59.37.234/32	TCP/443	Safelisting device access to Taegis XDR via hostname
AWS Data Collector IP or hostname	NTP severs IP/Hostnames provided during provisioning	UDP/123	Safelisting device access to NTP servers This rule is only necessary when custom NTP servers are provided during provisioning.
AWS Data Collector IP or hostname	169.254.169.123	UDP/123	Safelisting device access to default NTP server. This rule is only necessary when custom NTP servers are not provided during provisioning.
AWS Data Collector IP or hostname	DNS server IPs provided during provisioning	UDP/53 TCP/53	Safelisting device access to DNS servers

Proxy Support

Cloud-based and On-Premises Data Collectors attempt to discover local proxy settings on the host if they are unable to connect directly to the internet.

Cloud-based and On-Premises Data Collectors also support a hard-coded proxy. If you need to create a data collector that contains a hard-coded proxy, please submit a support request with the following required information:

• Proxy IP
• Proxy Port

If the proxy is configured but is unavailable or not reachable, the data collector will fall back to a direct connection.

Note

Cloud-based and On-Premises Data Collectors do not support hard-coded authenticated proxies at this time. A proxy with man in the middle (MITM) capability needs to safelist the above network connections.

Spool Log Cache

A 200GB spool log holds data when the forwarding connection to XDR is slowed or temporarily unavailable.

Virtual Machine Requirements

Important

Data Collectors only support x86-64-v2 micro-architecture level. The x86-64-v2 micro-architecture defines specific features on top of the x86-64 baseline architecture that is found on most modern CPUs that have a feature level matching the 2008 Intel Nehalem architecture. These features provide compile-time optimizations for increased speed and performance. Virtual Machine configurations that do not meet this requirement will fail to boot.

Virtual Machine Requirements:

• 4 vCPUs at 2Ghz or greater
• 20GB root disk
• 200GB secondary data disk
• 8GB of Memory

Configuration

XDR steps you through collector configuration and provides an .iso with credentials and configuration for the collector and an .ova virtual image that you then deploy in your environment.

Set Up On-Premises Data Collector with vSphere

The following steps guide you through installation of the XDR On-Premises Data Collector. It is assumed you have the preconfigured ISO and OVA files on hand. If you still need those, navigate to Integrations > Data Collectors in XDR or contact your XDR representative.

Install the On-Premises Data Collector on VMware vSphere

1. Make sure you have the .iso and .ova files you need to run the collector appliance. You can preconfigure and download those in XDR from Integrations > Data Collectors.

2. Connect to your vSphere Web Console.

3. Navigate to Virtual Machines and select Create / Register VM.

   

   Create or Register a VM

4. From Select Creation Type, select Deploy a virtual machine from an OVF or OVA file.

   

   Select Creation Type

5. Give your new VM a name such as taegis-xdr-collector and then select the .ova file you downloaded from the XDR integration manager (see Step 1 above).

   

   Select XDR .ova File

6. Select the appropriate datastore where you want to store the VM’s disk images.

   Important

   Choose a datastore with at least 220GB of free space for the VM. 20GB is needed for the primary and 200GB for the secondary drive.

7. Choose your preferred network and disk configurations.

8. Review the configuration and then select Finish.

9. Navigate to Storage and choose Datastore Browser.

   

   Select Datastore Browser

10. Select the datastore where you want to store the XDR On-Premises Data Collector configuration .iso (see Step 1).

11. Click Upload and select the configuration .iso.

12. Navigate back to Virtual Machines, and right-click the VM to bring up the context menu. Choose Edit Settings from the context menu.

    

    Edit Settings

13. Change the CDROM device from Client Device to Datastore ISO File.

    

    Select Datastore .iso

14. The Datastore Browser opens. From there select the .iso you uploaded in Step 11 and click Save to finalize the changes.

15. The VM is now ready to be powered on.

    Note

    When deploying an onsite collector the .ISO must be mounted at first boot to configure the XDR Collector. After the XDR Collector shows "READY" in XDR, the .ISO can be dismounted.

Set Up On-Premises Data Collector with Hyper-V

The following steps guide you through installation of the XDR On-Premises Data Collector using a Hyper-V environment. It is assumed you have the ctpx_collector.zip file on hand. If you still need that, navigate to Integrations > Data Collectors in XDR or contact your XDR representative.

Install the On-Premises Data Collector on Hyper-V

1. It is assumed you have the ctpx_collector.zip file on hand. If you still need that, navigate to Integrations > Data Collectors in XDR or contact your XDR representative. Unzip the ctpx_collector.zip file downloaded from XDR On-Premises Data Collector when you created your On-Premises Data Collector.

   Tip

   Place ctpx_collector.vhdx and ctpx-collector-disk2.vhdx in the same folder with the ctpx-collector.iso as it needs to be mounted to the CD drive on the Hyper-V machine.

   

   Unzip your ctpx-collector download

2. Open the Hyper-V Manager and select New, then select Virtual Machine... from the context popup in the upper right pane.

   

   Create a New Virtual Machine

3. The New Virtual Machine Wizard displays. Select Next.

   

   Virtual Machine Wizard

   The Specify Name and Location dialog displays.

4. Specify a name for the Virtual Machine then select Next.

   

   Virtual Machine Name

   The Specify Generation dialog displays.

5. Choose Generation 1 then select Next.

   

   Specify Generation

   The Assign Memory dialog displays.

6. Assign memory (see Virtual Machine Requirements above for recommended settings) and select Next.

   

   Assign Memory

   The Configure Networking dialog displays.

7. Choose the network adapter you are going to use with the virtual machine, then select Next.

   

   Configure Networking

   The Connect Virtual Hard Disk dialog displays.

8. Select Use an existing virtual hard disk and then browse to the location you chose in Step 1. Choose the ctpx-collector.vhdx file, then select Next.

   

   Connect Virtual Hard Disk

   The Completing the New Virtual Machine Wizard dialog displays.

9. Review the summary information and click Finish.

   

   Completing the New Virtual Machine Wizard

10. From the Hyper-V Manager, select the virtual machine in the Virtual Machines pane (upper center), then select Settings in the lower right pane.

    

    Hyper-V Manager

11. Select Processor from the Settings menu in the upper left-hand pane (see Virtual Machine Requirements above for recommended settings). Do NOT select OK or Apply at this step.

    

    Hyper-V Processor

12. Next, open IDE Controller 0 right below Processor. The IDE Controller details display in the right-hand pane.

    

    IDE Controller 0

    Choose Hard Drive then select Add.

13. Another Hard Drive appears under IDE Controller 0 in the left pane; it should be automatically selected. Select Browse..., navigate to the folder from Step 1, and choose ctpx-collector-disk2.vhdx. Do NOT select OK or Apply at this step.

    

    Second Hard Drive

14. Click on DVD Drive under IDE Controller 1 in the upper left pane. Choose Image file:, then Browse, navigate to the folder from Step 1, and choose ctpx-collector.iso. Do NOT select OK or Apply at this step.

    

    ctpx-collector.iso

15. Review the Processor, IDE Controller 0, and IDE Controller 1 entries on the left pane. Verify the following selections:

    Processor - 4 Virtual processors

    IDE Controller 0 - Hard Drive—ctpx-collector.vhdx - Hard Drive—ctpx-collector-disk2.vhdx IDE Controller 1 - DVD Drive—ctpx-collector.iso

    

    Verify Settings

    Once verified, click on OK. The Settings menu closes.

16. Select the virtual machine on under Virtual Machines in the Hyper-V Manager, right-click or otherwise bring up the context menu, and select Start.

    

    Start

17. The XDR On-Premises Data Collector is now running.

Set Up On-Premises Data Collector with Nutanix

The following steps guide you through installation of the XDR On-Premises Data Collector in a Nutanix environment. It is assumed you have downloaded the .qcow2 disk, preferred for Nutanix collectors, and have the ctpx-collector-nutanix.zip file on hand. If you still need those, navigate to Integrations > Data Collectors in XDR or contact your XDR representative.

Install the On-Premises Data Collector on Nutanix Prism

1. It is assumed you have downloaded the .qcow2 disk, preferred for Nutanix collectors, and have the ctpx-collector-nutanix.zip file on hand. If you still need that, navigate to Integrations > Data Collectors in XDR or contact your XDR representative.
2. Unzip the ctpx-collector-nutanix.zip file downloaded from XDR On-Premises Data Collector when you created your On-Premises Data Collector.
3. Place ctpx-collector.qcow2 and ctpx-collector-disk2.qcow2 in the same folder with the ctpx-collector.iso, as it needs to be mounted to the CD drive.

Upload Images files

The disk image files and configuration ISO need to be uploaded to the Nutanix system using the Nutanix Web UI.

1. Navigate to the Nutanix web console and log in.
2. Select Settings from the top dropdown menu.
3. Select Image Configuration from the left side Settings menu.

4. Select Upload Image and follow these steps:

   • Enter a name for the image, such as scwx-collector1. You will need this name in a later step.
   • Select DISK as the Image Type.
   • Select Choose File to upload ctpx-collector.qcow2 and select Save.

   

   Create Image One

5. Repeat the same for ctpx-collector-disk2.qcow2 with a name such as scwx-collector2. You will need this name in a later step.

   

   Create Image Two

6. Repeat for the .iso file with a name such as collector-iso and the Image Type as ISO.

   

   Create Image Three

7. Once the upload is complete, all three files appear on the Image Configuration page.

Setting Up the VM

1. Select VM from the top dropdown menu of the web console.
2. From the VM page, select + Create VM.

3. Enter the details of the VM:

   • A Name, such as Taegis-datacollector
   • Timezone = UTC
   • vCPUs = 4
   • Number of cores per vCPU = 1
   • Memory = 8

   

   Create VM

4. Scroll down to the Disks section and select the Edit pencil icon for the existing CD-ROM.

   

   Edit Disk

5. Modify the CD-ROM disk to use the .iso file as follows:

   • Operation = Clone from Image Service
   • Bus Type = IDE
   • Image = collector-iso
   • Select Update

   

   Update Disk

6. Add the two additional disk images to the VM by clicking + Add New Disk.

   

   Add New Disk

7. Add the first virtual disk file previously created, such as scwx-collector1:

   • Type = DISK
   • Operation = Clone from Image Service
   • Bus Type = SCSI
   • Image = scwx-collector1 or whatever you named ctpx-collector.qcow2 in the previous section
   • Select Add

   

   Add First Virtual Disk

8. Repeat the previous step for the second disk file, such as scwx-collector2:

   • Type = DISK
   • Operation = Clone from Image Service
   • Bus Type = SCSI
   • Image = scwx-collector2 or whatever you named ctpx-collector-disk2.qcow2 in the previous section
   • Select Add

   

   Add Second Virtual Disk

9. Scroll down to the Network Adapters (NIC) section, choose the network adapter you are going to use with the virtual machine. You can configure a network adapter by selecting + Add New NIC:

   Static IPDHCP

   If Static IP is used to configure the collector, modify the Assignment Type to Assign Static IP, enter in the assigned IP address for this VM as defined during collector configuration, and select Add.

   

   Static NIC

   If DHCP is used, use an appropriate subnet configured in the Nutanix portal that has DHCP enabled.

   

   DHCP NIC

10. Select Save and then Power On VM and your implementation is complete.

    

    Power On VM

Access Troubleshooting Console

The Admiral console allows you to access information about a deployed XDR Collector locally. The tools provided within Admiral assist in device setup and troubleshooting of common problems such as network connectivity.

For more information, see Admiral Console.

Edit Your XDR Collector Configuration

Important

Making changes to the XDR On-Premises Data Collector configuration of a live system carries the risk of rendering the device inoperable. The XDR On-Premises Data Collector will make every attempt possible to rollback to the previous configuration when a configuration change is unsuccessful. XDR On-Premises Data Collector configuration changes should be treated with the same level of caution used for any other kind of change in your environment according to your risk and change management guidelines. You should always be prepared to redeploy the device.

Certain configuration parameters of a running and healthy XDR On-Premises Data Collector can be changed on a live collector. To edit these parameters, select Actions and choose Edit Collector Configuration from a collector details page. Editable fields include the hostname, proxy settings, NTP server, and, for XDR On-Premises Data Collectors that have a static IP configuration, DNS servers. Modifications to the network interface configuration such as Static/DHCP, IP Address, Netmask, and Gateway are not editable fields on a XDR On-Premises Data Collector. If you require a change to the network interface configuration, it is required to provision a new XDR On-Premises Data Collector.

Edit Collector Details

Edit Collector Configuration Slideout

After submitting a XDR On-Premises Data Collector configuration change, a banner will appear to indicate that the change is pending and the edit action will no longer be available until the change has completed. The pending changes will be pushed to your XDR On-Premises Data Collector where they will be applied and connectivity testing conducted.

Edit Collector Configuration Pending

If the pending changes result in the XDR On-Premises Data Collector no longer able to successfully connect, the change will be rolled back to the previous configuration and a failure message will appear in the banner.

Edit Collector Configuration Rolled Back

If the change is successful, you will receive a successful message in the banner once the change has completed.

Edit Collector Configuration Success

In rare circumstances, it’s possible that the configuration change and rollback are both unsuccessful. Example scenarios include, but are not limited to, changes to the underlying network during the change or network connectivity failures to the backend during an inflight change. In these circumstances, you will see a failure banner and the XDR On-Premises Data Collector will need to be redeployed.

Edit Collector Configuration Failed

Once the change is complete, download the updated ISO for your records should you ever need to redeploy the XDR On-Premises Data Collector in the future. It is not necessary to attach the new ISO to the current running instance.

Manage Integrations Collector Downloads

XDR Collector Frequently Asked Questions

Do I need to take action to update the security of my XDR Collectors? What is the XDR Collectors patching process?

XDR Collectors update automatically and require no user intervention. Typically, XDR Collectors update every 24 hours based on the latest available published packages. If your collector is connected and healthy, it will automatically receive and apply these updates.

Are XDR Collectors configured with a secure baseline configuration?

Yes, XDR Collectors are designed utilizing DISA STIG guidelines.