Deploy the ExtraHop Explore Appliance in Azure
In this guide, you will learn how to deploy an ExtraHop Explore virtual appliance in a Microsoft Azure environment and join multiple Explore appliances to create an Explore cluster.
System requirements
Your environment must meet the following requirements to deploy a virtual Explore appliance:
- An Explore appliance product key
- An Azure storage account
- A Linux client with the latest updates installed
- The ExtraHop Explore 5100v virtual hard disk (VHD) file, available on the ExtraHop Customer Portal
- An Azure instance size that most closely matches the Explore appliance VM size, as
listed below:
Appliance Azure Instance Size EXA 5100v Basic A4, Standard A7, or Standard DS13
Important: | If you want to deploy more than one ExtraHop virtual appliance, create the new instance with the original deployment package or clone an existing instance that has never been started. |
Deploy the EXA 5100v
The following procedure is completed through the Azure classic deployment method. Additional configuration steps might be required for Azure Resource Manager deployments.
Before you begin
If you have not already done so, download the ExtraHop Explore appliance VHD file for Azure from the ExtraHop Customer Portal.-
On your Linux client, open a terminal application and run the following
commands.
- Sign into your Azure account.
- Save the .publishsettings file to your computer.
-
Return to your terminal application and run the following commands:
Configure the Explore appliance
After the Explore appliance is deployed in Azure, log into the Explore Admin UI through the following URL: https://<vm_name>.cloudapp.net/.
Note: | The default login username is setup and the password is default. |
Register the Explore appliance
Complete the following steps to apply a product key.
If you do not have a product key, contact your ExtraHop account team.
- In your browser, type the IP address of the Explore appliance (https://<vm_name>.cloudapp.net/).
- Review the license agreement, select I Agree, and then click Submit.
- On the login screen, type setup for the username and default for the password, and then click Log In.
- In the Appliance Settings section, click License.
- Click Manage License.
- Click Register.
- Enter the product key, and then click Register.
Configure the system time
By default, the Explore appliance synchronizes the system time through the pool.ntp.org network time protocol (NTP) server. If your network environment prevents the Explore appliance from communicating with this time server, you must configure an alternate time server source.
Note: | Time synchronization is critical to ensuring proper cluster operations and maintaining consistent views of data across both Discover and Explore appliances. We strongly recommend that you either keep the default system time setting or configure settings for a different NTP server. |
Configure email notifications
You must configure an email server and sender before the ExtraHop appliance can send notifications about system alerts by email.
You can receive the following alerts from the system:
- A virtual disk is in a degraded state.
- A physical disk is in a degraded state.
- A physical disk has an increasing error count.
- A registered Explore node is missing from the cluster. The node might have failed, or is powered off.
Create an Explore cluster
If you are deploying more than one Explore appliance, join the appliances together to create a cluster. For optimal performance, we recommend that you set up three or more Explore appliances in a cluster to take advantage of data redundancy.
In the following example, the Explore appliances have the following IP addresses:
- Node 1: 10.20.227.177
- Node 2: 10.20.227.178
- Node 3: 10.20.227.179
You will join nodes 2 and 3 to node 1 to create the Explore cluster.
Important: | Each node that you join must have the same configuration (physical or virtual) and ExtraHop firmware version. |
Connect the Explore appliance to Discover and Command appliances
After you deploy the Explore appliance, you must establish a connection from all ExtraHop Discover and Command appliances to the Explore appliance before you can query records.
Important: | If you have an Explore cluster of three or more Explore nodes, connect the Discover appliance to each Explore node so that the Discover appliance can distribute the workload across the entire Explore cluster. |
Note: | If you manage all of your Discover appliances from a Command appliance, you only need to perform this procedure from the Command appliance. |
Next steps
Important: | If you only deployed a single Explore appliance, after you connect to your Discover or Command appliance, you must log into the Admin UI on the Explore appliance and set the 0. | to
Send record data to the Explore appliance
After your Explore appliance is connected to all of your Discover and Command appliances, you must configure the type of records you want to store. See the following documentation for more information about Explore configuration settings, how to generate and store records, and how to create record queries.
- ExtraHop Explore Admin UI Guide
- ExtraHop Explore Settings section in the ExtraHop Admin UI Guide.
- Records section in the ExtraHop Web UI Guide.
- ExtraHop Trigger API Reference
Thank you for your feedback. Can we contact you to ask follow up questions?