Identify the bridge through which you will access the management interface of your Explore appliance.

1. Make sure the management bridge is accessible to the Explore virtual appliance and to all users who must access the management interface.
2. If you need to access the management interface from an external computer, configure a physical interface on the management bridge.

After you identify the management bridge, edit the configuration file, and create the Explore virtual appliance.

1. Contact ExtraHop Support (support@extrahop.com) to obtain and download the Explore KVM package.
2. Extract the tar.gz file that contains the installation package.
3. Copy the two disks extrahop-boot.qcow2 and extrahop-data.qcow2 to your KVM system. Make a note of the location where you store these files.
4. Open the domain XML configuration file in a text editor and edit the following values:
   1. Change the VM name to a name for your ExtraHop virtual appliance.
      For example:

      <name>ExtraHop-EXA-S</name>

   2. Change the source file path ([PATH_TO_STORAGE]) to the location where you stored the virtual disk files in step 3.

      <source file='[PATH_TO_STORAGE]/extrahop-boot.qcow2'/> 
      <source file='[PATH_TO_STORAGE]/extrahop-data.qcow2'/>

   3. Change the source bridge for the management network (ovsbr0) to match the name of your management bridge.

      <interface type='bridge'>
         <source bridge='ovsbr0'/>
         <model type='virtio'/>
         <alias name='net0'/>
         <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
      </interface>

   4. (Optional) If your virtual bridge is configured through Open vSwitch virtual switch software, add the following virtualport type setting to the interface (after the source bridge setting):

      <virtualport type='openvswitch'>
      </virtualport>

5. Save the XML file.
6. Create the new Explore virtual appliance with your revised domain XML configuration file by running the following command:

   virsh define <EXA_KVM_x.xml>

   Where <EXA_KVM_x.xml> is the name of your domain XML configuration file.

Resize the datastore disk so that the allotted space is large enough to store the type of records you want to store for the amount of lookback desired.

qemu-img resize extrahop-data.qcow2 <+nGB>

qemu-img resize extrahop-data.qcow2 +100GB

1. Start the VM by running the following command:

   virsh start <vm_name>

   Where <vm_name> is the name of your ExtraHop virtual appliance you configured in step 4 of the Edit the domain XML file section.
2. Log in to the KVM console and view the IP address for your new ExtraHop virtual appliance by running the following command:

   virsh console <vm_name>

By default, ExtraHop appliances ship with DHCP enabled. If your network does not support DHCP, you must configure a static address manually.

1. Log into the KVM host.
2. Run the following command to connect to the ExtraHop appliance through the virtual serial console:

   virsh console <vm_name>

   Where <vm_name> is the name of your virtual machine.

3. Press ENTER twice to get to the appliance login prompt.

   ExtraHop Discover Appliance Version 6.2.6.3385
   IP: 192.0.2.81
   exampleium login: 

4. At the login prompt, type shell, and then press ENTER.
5. At the password prompt, type default, and then press ENTER.
6. To configure the static IP address, run the following commands:
   1. Enable privileged commands:

      enable

   2. At the password prompt, type default, and then press ENTER.
   3. Enter configuration mode:

      configure

   4. Enter the interface configuration mode:

      interface

   5. Run the ip command and specify the IP address and DNS settings in the following format: ip ipaddr <ip_address> <netmask> <gateway> <dns_server>
      For example:

      ip ipaddr 10.10.2.14 255.255.0.0 10.10.1.253 10.10.1.254

   6. Leave the interface configuration section:

      exit

   7. Save the running config file:

      running_config save

   8. Type y and then press ENTER.

Complete the following steps to apply a product key.

nslookup -type=NS d.extrahop.com

Non-authoritative answer:
d.extrahop.com	nameserver = ns0.use.d.extrahop.com.
d.extrahop.com	nameserver = ns0.usw.d.extrahop.com.

1. In your browser, type the URL of the ExtraHop Admin UI, https://<extrahop_ip_address>/admin.
2. Review the license agreement, select I Agree, and then click Submit.
3. On the login screen, type setup for the username.
4. For the password, select from the following options:
   • For 1U and 2U appliances, type the service tag number found on the pullout tab on the front of the appliance.
   • For the EDA 1100, type the serial number displayed in the Appliance info section of the LCD menu. The serial number is also printed on the bottom of the appliance.
   • For a virtual appliance, type default.
5. Click Log In.
6. In the Appliance Settings section, click License.
7. Click Manage License.
8. Click Register.
9. Enter the product key and then click Register.
10. Click Done.

By default, the Explore appliance synchronizes the system time through the pool.ntp.org network time protocol (NTP) server. If your network environment prevents the Explore appliance from communicating with this time server, you must configure an alternate time server source.

1. In the Appliance Settings section, click System Time.
2. Click Configure Time.
3. Click the Time Zone drop-down list and select a time zone. Click Save and Continue.
4. Select the Set time with NTP server radio button and then click Select.
5. Type the IP address or hostname for the time server, and then click Save.

   Note:

   You can configure up to 9 time servers.

6. Click Done.
7. Click Sync Now to sync system time on the Explore appliance with the remote time server.

You must configure an email server and sender before the ExtraHop appliance can send notifications about system alerts by email.