Introduction

Field Effect MDR's appliances, both the primary and secondary device types, can de deployed physically within your network, or within a virtualized environment. 

To learn more about our appliances; the difference between primary and secondary devices, overviews, and more, visit our Help Center content on appliances.  

The virtual appliance installed in Azure acts as the primary appliance receiving telemetry from endpoint agents and secondary remote sensor. A virtual appliance may also act as a remote sensor, which would send data to an existing primary appliance.

Setting up the Virtual Appliance (Azure)

This section walks through the process of creating an Azure Virtual Appliance. The first step is to ensure that you have requested a self-hosted Azure virtual appliance. You will then be able to download a cloud-init user data YAML file provided by Field Effect in the Downloads page of the MDR Portal. Download this file and rename it to "cloud-init-covalence.txt."

This process uses the Azure CLI so the size of the disk used for the Operating System (OS) can be specified. The commands below assume a bash shell – either via the Azure Cloud Shell or local Linux/WSL environment using the Azure CLI.

1. Open a command prompt and create a new working directory “covalence-setup”; “cd covalence-setup”

2. Copy the "cloud-init-covalence.txt" file from above to this directory as “cloud-init-covalence.txt”

3. Install Azure Command Line Interface (CLI) if not already installed (Installing Azure CLI)

4. Login: “az login”

5. Create a resource group, in your preferred region:

az group create \

--name covalenceResourceGroup \

--location eastus

6. Create the VM. The SSH keys and “admin-username” argument are superseded by the cloud-init configuration, but they need to be provided. Change the ‘os-disk-size’ argument and ‘size’ argument depending on guidance from Field Effect:

az vm create \

--resource-group cloud-init \

--assign-identity [system] \

--name Covalence \

--image canonical:0001-com-ubuntu-server-focal:20_04-lts:latest \

--custom-data cloud-init-covalence.txt \

--size Standard_E4s_v3 \

--admin-username covalence-admin \

--nsg-rule NONE \

--generate-ssh-keys \

--os-disk-size-gb 1024

Traffic Monitoring Configuration in Azure

Please reach out to support@fieldeffect.com to configure traffic monitoring, as it requires custom configuration by our support and operations teams. There are some options available for traffic monitoring:

• Configure Traffic Montiroing in Azure
• Packet Capture via Azure Network Watcher. This functionality is limited to 10 VMs per region, per subscription.

NOTE: The virtual appliance does not act as a NAT gateway by default - this requires additional configuration and coordination with Field Effect.