Open the vSphere client, and click File > Add OVF template to create an OVF template for the Network Sensor Virtual Appliance (NSVA) that will be used to configure and activate the Network Sensor in your environment.

You can select a template from:

After selecting the OVF template click Next.

Name the network sensor virtual appliance and select the deployment location.

Click Next.

Select the target endpoints in your environment where to deploy the Network Sensor probes and then click Next.

Verify the details of your NSVA template and click Next.

On the Select storage page, define where and how to store the files for the deployed NSVA template.

1. Select the disk format for the virtual machine virtual disks.

   Choose from the available options:

   • Thick Provision Lazy Zeroed

   • Thick Provision Eager Zeroed

   • Thin Provision

   

2. Select a storage policy.

   Note

   This option is available only if storage policies are enabled on the target endpoints.

3. Select a datastore to store the deployed NSVA template.

   The configuration file and virtual disk files are stored on the datastore. Select a datastore large enough to accommodate the virtual appliance and all associated virtual disk files.

On the Select networks page:

1. Select the network interface that establishes communication between the Network Sensor appliance and GravityZone .

2. Select the SPAN network that will be monitored by the Network Sensor probes.

   Important

   After deployment, the monitored network's subnet must be set in the network sensor by running the sva_setup.sh script. For more information, refer to Configure the Network Sensor virtual appliance.

Click Next.

Optionally, customize the NSVA deployment properties and click Next.

On the Ready to complete page, review the details and click Finish.

After the creation task is completed, open your Network Sensor virtual appliance and start the configuration process.

Download the Network Sensor virtual machine kit in one of the following formats:

Open Hyper-V Manager and from the Action pane click New > Virtual Machine... to create a virtual machine that will be used to configure and activate the Network Sensor in your environment.

In the Before You Begin window, click Next to create a virtual machine with a custom configuration.

In the Specify Name and Location window, add your virtual machine name and the location where the image was downloaded.

In the Specify Generation window you must:

In the Assign Memory window, set the Startup memory to 2048 MB.

In the Configure Networking window, set the Connection to the desired network interface.

In the Connect Virtual Hard Disk window select the Use an existing virtual hard disk option and browse for the location of the downloaded Network Sensor VHD kit.

In the Summary page, review the details and click Finish.

In Hyper-V Manager right-click the newly created virtual machine, and go Settings.

1. If the Generation 2 virtual mchine was selected, go to Security and select Microsoft UEFI Certificate Authority from the Template dropdown list.

   

2. Go to Add Hardware and select Network Adapter to add the SPAN network that will be monitored by the Network Sensor probes.

   

   Important

   After deployment, the monitored network's subnet must be set in the network sensor by running the sva_setup.sh script. For more information, refer to Configure the Network Sensor virtual appliance.

3. Select the desired SPAN network and click Apply .

   

4. Open Advanced Features of the SPAN network adapter and set the Port mirroring mode to Destination, then click Apply.

   

Start the Network Sensor virtual machine and begin the configuration process.

Register your managed application in Microsoft Azure AD.

Set up permissions in Microsoft Graph API > Application permissions according to how you want to configure the sensor:

1. If you want to be able to receive events and also be able to take response actions for O365 incidents directly from GravityZone, the following permissions are needed:

   • AuditLog.Read.All

   • Mail.ReadWrite, for deleting emails

   • User.ReadWrite.All, for enforcing password resets and disabling of accounts

     Important

     To enforce password resets on O365 accounts directly from GravityZone XDR incidents, you must assign the User administrator role to the Azure app.

     In the Azure AD admin center, navigate to Roles and administrators > User administrator role > Add assignments, search for the application name used for the GravityZone O365 Mail sensor integration and assign it.

   • IdentityRiskyUser.ReadWrite.All, for marking a user account as compromised

     Important

     IdentityRiskyUser.ReadWrite.All requires an Azure AD Premium P2 license. The other permissions require an Azure AD Premium P1 license.

2. If you only want to be able to receive events but not take response actions for O365 incidents directly from GravityZone incidents, the following permissions are sufficient: AuditLog.Read.All, Mail.Read and User.Read.All.

Grant Admin consent.

Generate Client secret value.

Register your managed application in Microsoft Azure AD.

Set up permissions according to how you want to configure the sensor:

1. If you want to be able to receive events and also be able to take response actions for O365 incidents directly from GravityZone:

   1. In the Microsoft Graph API > Application permissions section, add the following permissions: User.ReadWrite.All and IdentityRiskyUser.ReadWrite.All.

   2. In the Office 365 Management APIs > Application permissions section, add the following permissions: ActivityFeed.Read, ActivityFeed.ReadDlp and ServiceHealth.Read.

   Important

   To enforce password resets on O365 accounts directly from GravityZone XDR incidents, you must assign the User administrator role to the Azure app.

   In the Azure AD admin center, navigate to Roles and administrators > User administrator role > Add assignments, search for the application name used for the GravityZone O365 Mail sensor integration and assign it.

   Important

   IdentityRiskyUser.ReadWrite.All requires an Azure AD Premium P2 license. The other permissions require an Azure AD Premium P1 license.

2. If you only want to be able to receive events but not take response actions for O365 incidents directly from GravityZone incidents, set the following permissions in Office 365 Management APIs > Application permissions: ActivityFeed.Read, ActivityFeed.ReadDlp and ServiceHealth.Read.

Grant Admin consent.

Generate the Client secret value.

Navigate to Microsoft Compliance > Audit and start recording user and admin activity.

Enable the Audit.AzureActiveDirectory, Audit.Exchange, Audit.General, Audit.SharePoint, and DLP.All subscriptions by running the PowerShell script bellow. Make sure you replace the values in the first four lines of code:

$ClientID = "client_id"           // @todo replace with your client id, e.g: f5b17a13-6e4e-4c3e-81f4-51fb9a377182
$ClientSecretValue = "client_secret_value"   // @todo replace with your client secret value, e.g: UOJ7Q~YN5hkilURseLkfRN6~kTQp80Fndn9eJ
$tenantdomain = "tenant_domain"   // @todo replace with your tenant domain, e.g: albert@osf.onmicrosoft.com
$TenantGUID = "tenant_guid"		  // @todo replace with your tenant guid,  e.g: ac593d47-7293-47ed-a8fc-c5824d38673a


$body = @{grant_type="client_credentials";resource="https://manage.office.com";client_id=$ClientID;client_secret=$ClientSecretValue}
$oauth = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$TenantGUID/oauth2/token?api-version=1.0" -Body $body
$headerParams = @{'Authorization'="$($oauth.token_type) $($oauth.access_token)"}

$p = @{
    "webhook"= $null
}

Invoke-WebRequest "https://manage.office.com/api/v1.0/$TenantGUID/activity/feed/subscriptions/start?contentType=Audit.AzureActiveDirectory" -Headers $headerParams -Method POST -Body $p -UseBasicParsing
Invoke-WebRequest "https://manage.office.com/api/v1.0/$TenantGUID/activity/feed/subscriptions/start?contentType=Audit.Exchange" -Headers $headerParams -Method POST -Body $p -UseBasicParsing
Invoke-WebRequest "https://manage.office.com/api/v1.0/$TenantGUID/activity/feed/subscriptions/start?contentType=Audit.SharePoint" -Headers $headerParams -Method POST -Body $p -UseBasicParsing
Invoke-WebRequest "https://manage.office.com/api/v1.0/$TenantGUID/activity/feed/subscriptions/start?contentType=Audit.General" -Headers $headerParams -Method POST -Body $p -UseBasicParsing
Invoke-WebRequest "https://manage.office.com/api/v1.0/$TenantGUID/activity/feed/subscriptions/start?contentType=DLP.All" -Headers $headerParams -Method POST -Body $p -UseBasicParsing

In the Configuration > Sensors Management page, click Add new to integrate a new sensor platform.

Select the Office 365 sensor platform and click Integrate.

On the Check requirements page, confirm that the prerequisite steps have been completed.

Name your sensor integration.

Fill out your Office 365 credentials: Application ID, Tenant ID, and Client Secret value.

Click Test connectivity to make sure the link between the Office 365 platform and GravityZone is working properly.

Click APPLY to save the sensor integration setup.

In the Configuration > Sensors Management page, select Add new to integrate a new sensor.

Select the Active Directory sensor and click Integrate.

On the Check Requirements page, confirm that the prerequisite steps have been completed.

Click on the domain you want to monitor. A list of its domain controllers will be displayed.

Select Apply.

Go to Security Credentials > Users > your IAM user > Add inline policy > JSON.

Copy and paste the following new setup policy to gain the necessary rights:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:GetBucketNotification",
                "s3:PutBucketNotification",
                "s3:ListAllMyBuckets",
                "s3:PutBucketPolicy",
                 
                "sqs:GetQueueAttributes",
                "sqs:CreateQueue",
                "sqs:SetQueueAttributes",
                "sqs:DeleteQueue",
                "sqs:ListQueues",
                 
                "sns:Subscribe",
                "sns:CreateTopic",
                "sns:ListTopics",
                "sns:SetTopicAttributes",
                "sns:DeleteTopic",
                 
                "iam:PassRole",
                "iam:CreateServiceLinkedRole",
                 
                "cloudtrail:PutEventSelectors",
                "cloudtrail:StopLogging",
                "cloudtrail:StartLogging",
                "cloudtrail:CreateTrail",
                "cloudtrail:DeleteTrail",
                 
                "config:DescribeDeliveryChannels",
                "config:PutConfigurationRecorder",
                "config:StartConfigurationRecorder",
                "config:PutDeliveryChannel",
                "config:DescribeConfigurationRecorders",
                "config:DeleteDeliveryChannel",
                "config:DeleteConfigurationRecorder"
            ],
            "Resource": "*"
        }
    ]
}

Click Review.

Click Save.

Go back to Add inline policy > JSON.

Copy and paste the following sensor policy, updating the value for arn:aws:sqs and arn:aws:iam with your Account ID:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "sqs:DeleteMessage",
                "sqs:PurgeQueue",
                "sqs:ReceiveMessage",
                "iam:ListPolicies",
                "iam:AttachUserPolicy",
                "iam:CreatePolicy",
                "iam:DeleteAccessKey",
                "iam:ListAccessKeys"
            ],
            "Resource": [
                "arn:aws:sqs:*:"account-ID":*",
                "arn:aws:iam::"account-ID":*",
                "arn:aws:s3:::*"
            ]
        }
    ]
}

Click Review.

Click Save.

Create an S3 bucket.

1. In the S3 section, click Create Bucket.

2. Copy the bucket Amazon Resource Name (ARN) for later use.

Create an SQS queue.

1. In the SQS section, click Create Queue.

2. Copy the SQS ARN and Queue URL for later use.

Replace the access policy attached to the queue with the following policy:

1. In the Amazon SQS console, choose the queue name in the Queues list.

2. In the Access policy tab, select Edit.

3. Replace the access policy attached to the queue with the following policy, updating the values for:

   • awsexamplebucket1: replace it with the value you copied in step 1.

   • SQS-queue-ARN: replace it with the value you copied in step 2.

   • bucket-owner-account-id: replace it with your account ID. You can find it by clicking on your name on the top right corner of the screen.

   You can also replace the values for the ID and SID, to further customize the policy.

   {
    "Version": "2012-10-17",
    "Id": "example-ID",
    "Statement": [
     {
      "Sid": "example-statement-ID",
      "Effect": "Allow",
      "Principal": {
       "Service": "s3.amazonaws.com" 
      },
      "Action": [
       "SQS:SendMessage"
      ],
      "Resource": "SQS-queue-ARN",
      "Condition": {
         "ArnLike": { "aws:SourceArn": "awsexamplebucket1" },
         "StringEquals": { "aws:SourceAccount": "bucket-owner-account-id" }
      }
     }
    ]
   }

4. Click Save.

Enable notifications for the bucket you have created.

1. Go to the bucket you created.

2. Click Properties.

3. In the Event Notifications section, select Create event notification.

4. In the General configuration section, specify a name for your event notification.

5. In the Event types section, select one or more event types for which you want to receive notifications.

6. In the Destination section, choose the SQS queue you have previously created.

7. Click Save changes.

Create an access key.

1. In the Security Credentials section, click Access Keys.

2. Select Create New Access Key to download your new access key.

Create a CloudTrail and link it to the S3.

1. In the CloudTrail section, click Create Trail.

2. Select the Use existing S3 bucket option, then select the bucket you previously created.

3. Click Next.

4. Select the Management events and Data events check boxes.

5. In the Data Events section, select S3 as the event type.

6. Click Next and then Create Trail.

Configure AWS Config.

1. Go to the Config service.

2. Click Get Started.

3. Select the Record all resources supported in this region option.

4. Select the Include global resources check box.

5. Depending on the desired configuration, create a new bucket or select an existing one. If a new bucket is created, new rights should be added to the SQS queue. For information on adding rights to an SQS queue, refer to step 3.c.

6. Select the Stream configuration changes and notifications to an Amazon SNS topic checkbox.

7. Create a new topic or use an existing one.

8. Click Next > Next > Confirm.

9. Go to the SQS queue you have created.

10. Click Subscribe to Amazon SNS Topic and choose the topic from step 7.g.

11. Click Save.

Navigate to Security Credentials > Users > your IAM user > Add inline policy > JSON.

Delete the new setup policy you have previously created in Configure AWS permissions.

In the Configuration > Sensors Management page, select Add new to integrate a new sensor.

Select the AWS sensor and click Integrate.

On the Check Requirements page, confirm that the prerequisite steps have been completed.

Name the integration and provide the necessary AWS details.

Select Test connectivity.

Select Add sensor.

Register your managed application in Microsoft Azure AD, unless you have one already.

In the API Permissions > Microsoft Graph application section, grant the following permissions according to how you want to configure the sensor:

1. If you want to be able to receive events and also be able to take response actions for Azure AD incidents directly from GravityZone, the following permissions are needed:

   • AuditLog.Read.All

   • Directory.Read.all

   • Mail.ReadWrite, for deleting emails

   • User.ReadWrite.All, for enforcing password resets and disabling of accounts

     Important

     To enforce password resets on O365 accounts directly from GravityZone XDR incidents, you must assign the User administrator role to the Azure app.

     In the Azure AD admin center, navigate to Roles and administrators > User administrator role > Add assignments, search for the application name used for the GravityZone Azure AD sensor integration and assign it.

   • IdentityRiskyUser.Read.All, for displaying Azure AD risky user information in the Graph details panel.

   • IdentityRiskyUser.ReadWrite.All, for marking a user account as compromised

     Important

     IdentityRiskyUser.ReadWrite.All and IdentityRiskyUser.Read.All require an Azure AD Premium P2 license. The other permissions require an Azure AD Premium P1 license.

2. If you only want to be able to receive events but not take response actions for Azure AD incidents directly from GravityZone incidents, the following permissions are sufficient:

   • AuditLog.Read.All

   • Directory.ReadAll

Grant Admin consent.

Generate Client secret, unless you have one already

In the Configuration > Sensors Management page, select Add new to integrate a new sensor.

Select the Azure AD sensor and click Integrate.

On the Check Requirements page, confirm that the prerequisite steps have been completed.

Name the integration and provide the necessary Azure AD details.

Select Test connectivity.

Select Add sensor.

Register your managed application in Microsoft Azure AD, unless you have one already.

Create a subscription, if you don't already have one you can use.

Create a role and set the necessary permissions.

1. In the Azure Portal, search for Subscriptions.

2. On the Subscriptions page, click on the subscription you have just created.

3. To add a new role, click on Access control (IAM) > Roles > Add > Add custom role.

4. Give it a name, a description, select Start from scratch, then click Next.

5. Click on Add permissions and search for Microsoft.Insights/eventtypes/values/Read.

6. Select the Read: Read Activity Log checkbox and click the Add button.

   

7. Click the Review + create button.

Assign the newly created role to the application you registered at Step 1.

1. Go to the Subscriptions page and select the subscription you created.

2. Click on Access control (IAM) >  Role assignments > Add > Add role assignment.

3. Select the role you created and click Next.

4. In the Members tab, for the Assign access to field, select User, group, or service principal.

5. Click Select members.

   

6. Search for your application and click Next.

7. Click the Review + assign button.

Generate Client secret, unless you have one already.

In the Configuration > Sensors Management page, select Add new to integrate a new sensor.

Select the Azure Cloud sensor and click Integrate.

On the Check Requirements page, confirm that the prerequisite steps have been completed.

Name the integration and provide the necessary Azure Cloud details.

Select Test connectivity.

Select Add sensor.

Register your managed application in Microsoft Azure AD, unless you have one already.

In the API Permissions > Microsoft Graph application section, grant the following permission: DeviceManagementApps.Read.All.

Grant Admin consent.

Generate Client secret, unless you have one already.

In the Configuration > Sensors Management page, select Add new to integrate a new sensor.

Select the Microsoft Intune sensor and click Integrate.

On the Check Requirements page, confirm that the prerequisite steps have been completed.

Name the integration and provide the necessary Microsoft Intune details.

Select Test connectivity.

Select Add sensor.

Create a Google application, unless you already have one you can use for this purpose.

1. Go to https://console.cloud.google.com/apis/dashboard.

2. If the dashboard is empty, click Create project, name your project, and click Create.

3. Click the Enable APIs and services tab.

4. Look up the following services: Admin SDK API, Gmail API, and Google Drive API.

5. Click each service and enable it.

Create a service account, unless you already have one.

1. On the left-side menu, click Credentials.

2. Under the Service Accounts section, click Create service account.

3. Fill out the form and click Done. Steps 2 and 3 are optional.

   

Generate credentials for your service account.

1. On the left-side menu, click Credentials.

2. Under the Service Accounts section, click the email address listed.

3. Click the Keys tab.

4. Click Add key > Create a new key.

5. Select JSON as the Key type and click Create.

   

   Note

   The file downloaded contains your service account details. You will require this file and some of the information in it (Client ID, Client email and Private key) to successfully set up the sensor.

In the Admin Console, add the necessary permissions.

1. Using an Administrator account, go to admin.google.com.

2. On the left-side menu, click Security > Access and data control > API controls.

3. Click Manage domain-wide delegation.

4. Click Add new.

5. Provide the Client ID listed in the downloaded file from step 3.

6. In the OAuth scopes field, add the following scopes:

   1. https://www.googleapis.com/auth/admin.directory.user.readonly

   2. https://www.googleapis.com/auth/admin.reports.audit.readonly

   3. https://www.googleapis.com/auth/gmail.readonly

   4. https://www.googleapis.com/auth/drive.readonly

7. Click Authorise.

In the Configuration > Sensors Management page, select Add new to integrate a new sensor.

Select the Google Workspace sensor and click Integrate.

On the Check Requirements page, confirm that the prerequisite steps have been completed.

Name the integration and provide the necessary Microsoft Intune details.

1. In the Administrator account details section, add the email address you used to log into admin.google.com, at step 4 of the Prerequisites procedure. Provide the domain you want to monitor.

2. In the Service account details section, provide the required information from the document you downloaded at step 3 of the Prerequisites procedure.

Select Test connectivity.

Select Add sensor.