Web Portal Configuration

Adding a Sensor to the Web Portal

Add a Sensor's Public IP Address to the Stealthwatch Cloud Web PortalFrom the sensor's command line, you can identify its public IP address, then add that to the Stealthwatch Cloud web portal to establish the initial connection between your portal and the sensor. If you cannot identify the public IP address, go to the next page to use the portal's unique service key to associate the sensor with the portal.

SSH log into the sensor.

At the prompt, enter curl https://sensor.ext.obsrvbl.com and press Enter. If the console displays "error": "unknown identity" then this sensor is not associated with a web portal.

Copy the identity IP address.

Log out of the sensor.

Log into the web portal as a site administrator.

Select Settings > Sensors > Public IP.

Paste the identity IP address in the Public IP field.

Click Add IP. After the portal and sensor exchange keys, they establish future connections using the keys, not the public IP address. NOTE: It can take up to 10 minutes before a new sensor is reflected in the portal.

Watch the video below, or follow the procedure to the left, for more information.

Add a Sensor's Public IP Address

Add a Web Portal's Service Key to a SensorIn certain situations, you might not be able to add a sensor's public IP address to the web portal, such as when you are using a proxy service. In these situations, edit the sensor's config.local file instead to include the portal's service key and establish a connection.

Log into the web portal UI as a site administrator.

Select Settings > Sensors.

Copy the Service key at the end of the sensor list.

SSH log into the sensor as an administrator.

At the prompt, enter sudo nano /opt/obsrvbl-ona/config.local and press Enter.

Beneath the line # Service Key, add the line OBSRVBL_SERVICE_KEY="<service-key>" and replace <service-key> with the web portal's service key.

Press Ctrl + 0 to save your changes.

Press Ctrl + x to exit.

At the prompt, enter sudo service obsrvbl-ona restart to restart the Stealthwatch Cloud service. NOTE: It can take up to 10 minutes before a new sensor is reflected in the portal.

Watch the video below, or follow the procedure to the left, for more information.

Add a Web Portal's Key to a Sensor

Configure a Sensor's Flow Data IngestionAfter you add the sensor, configure the type of flow data that it ingests from the sensor's settings in the web portal.

Log into the web portal UI as a site administrator.

Select Settings > Sensors.

Click Change settings for the sensor you added.

Select NetFlow/IPFIX. NOTE: If you do not see this option, select Help (?) > Sensor Install to download a current version of the sensor ISO.

Click Add New Probe.

Select a flow type from the Probe Type drop-down.

Enter a Port number. NOTE: If you want to pass Flexible NetFlow to your sensor, ensure that the UDP port you configure is not one that is also configured for Flexible NetFlow or IPFIX in your sensor configuration. See the Configuration Guide for Enhanced NetFlow for more information.

Select a Protocol.

Select a Source device from the drop-down.

Click Save.

Watch the video below, or follow the procedure to the left, for more information.

Configure a Sensor's Flow Data Ingestion