# Deploy and Install

The installation process depends on where you deploy Logpoint.

There are five different ways to deploy On-prem SIEM:

* [ISO file or image](#iso-file-or-image)
* [Open Virtualization Appliance (OVA) on a VMWare ESXi server v7.0.3 or later](#open-virtualization-appliance-ova)
* [Amazon Machine Image (AMI) on Amazon Web Services](#amazon-machine-image-ami)
* [Virtual Hard Disk (VHD) on Microsoft Azure](#vhd-on-microsoft-azure)
* [Virtual Hard disk (VHD) on Microsoft Hyper-V Server 2016 or later](#virtual-hard-disk-vhd-on-microsoft-hyper-v-server-2016-or-later)

If it is not the latest version, we recommend you upgrade Logpoint to the latest version after you deploy it. To upgrade or install a patch, go to Upgrades and Patches. Before installing patch, check the product versions compatibility in the [Compatibility Matrix](https://docs.logpoint.com/siem/product-docs/readme/a_predeployment/version_compatibility_matrix).

### Installation

After deployment, you must:

1. Verify access or connect to the deployment. How you verify access depends on the deployment type.
2. Setup the Logpoint server or instance. A Logpoint server or instance can be:
   1. **Standard or Compliance mode** — preconfigured dashboards and repositories for access management, incident management, and perimeter security monitoring. Dashboards come with ready-to-use widgets for compliance, and repositories are mapped to specific source types (firewalls, servers).
   2. **Custom Configuration** — you setup dashboards and repositories yourself.
   3. **Collector** — retrieves logs from sources, buffers them, normalizes logs into key-value pairs, applies static enrichment, and forwards to a Logpoint Storage Node.
   4. **Syslog Forwarder** — collects and normalizes logs (including from syslog collectors) and forwards them to Logpoint via TCP port 514.
3. Configure each relevant interface (DHCP or Manual/static). See network-specific sections per deployment type below.
4. Customize storage partitions during installation using automatic partitioning or customize partitions (create GPT partitions, LVM groups, logical volumes).
5. [Upload your license](https://docs.logpoint.com/siem/product-docs/readme/deploy-and-install/license).

<details>

<summary>ISO File or Image</summary>

For a fresh installation, download the latest Logpoint ISO file from [Product Hub](https://servicedesk.logpoint.com/hc/en-us/sections/201727565-SIEM) and download the latest Logpoint ISO.

{% hint style="danger" %}
The installation process completely cleans the disk, ensure that you back up your files before proceeding.&#x20;
{% endhint %}

**Prepare and boot**

1. Prepare a bootable medium (USB drive or virtual drive for VMs) using the latest Logpoint ISO.
2. Boot your system using the bootable medium. Warning messages may appear during the first boot; these can be ignored.

**Configure network connections**

1. By default, Logpoint uses IPv4 protocol with **Automatic (DHCP)** configuration. You may manually set up network interfaces or proceed with default configurations.
2. For multiple-interface systems, enable and configure additional interfaces manually. Go to [configuring network interfaces](#configuring-network-interfaces) for more information.

![](https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FqfaiD49EdFUJV5Kl6Q4w%2Fimage.png?alt=media\&token=f6514b83-b0e3-413d-871a-6970695c40cb)<br>

**Click Done.**

**Storage partitioning (automatic or manual)**

To manually customize storage, click **Reset** during installation. Automatic partitioning default layout:

| Partition | Mount Point | Size    |
| --------- | ----------- | ------- |
| boot      | /boot       | 1GB     |
| swap      |             | 8GB\`\` |

The remaining space is used for the following volumes:

| Volume      | Mount Point            | Size                |
| ----------- | ---------------------- | ------------------- |
| root        | /                      | 40GB                |
| application | /opt                   | 20GB                |
| app\_store  | /opt/immune/app\_store | 20GB                |
| storage     | /opt/immune/storage    | All remaining space |

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2F6qxwrWXxbDZ2wdE8uZCs%2Fimage.png?alt=media&#x26;token=5557aad6-877d-44f9-9bbe-36a79601d2d1" alt=""><figcaption></figcaption></figure>

**Start installation and reboot**

1. Click **Done** and **Continue** to confirm disk cleanup and start installation.
2. When prompted, click **Reboot Now**. If installation fails, erase all disk data before reinstalling.
3. After installation, eject the boot disk or select hard drive as boot device in B**oot Manager** to avoid re-running the installer.

**Initial login and password change**

1. Log in on the console with:

<pre><code>Username: admin
<strong>Password: changeme
</strong></code></pre>

2. Immediately change the password using the `passwd` command. Password requirements:

* Minimum 15 characters.
* Include a lowercase letter, an uppercase letter, a digit, and a special character.
* At least four characters must differ from the old password.

3. Use `ifconfig` command to view the IP address. Enter the IP in your browser to access the Logpoint UI.
4. UI login (first time):

```
Username: admin
Password: changeme
```

5. Change password and click **Save.**

</details>

<details>

<summary>Open Virtualization Appliance (OVA)</summary>

The Logpoint open virtualization appliance (OVA) allows you to launch a Logpoint virtual machine in the **VMWare ESXi server** v7.0.3 or later.

With the Logpoint OVA, you can use:

* **Virtualization** to transform data centers into simplified cloud computing infrastructures and use flexible and reliable IT services. VMware vSphere virtualizes and aggregates the underlying physical hardware resources across multiple systems and provides pools of virtual resources to the data center.
* **Managed Infrastructure** to utilize large collections of infrastructures such as CPUs, storage, and networking as a seamless and dynamic operating environment without worrying about the complexity of a data center.

**Deploy OVA**

1. Go to [Product Hub](https://servicedesk.logpoint.com/hc/en-us/sections/201727565-SIEM) and download the .ova file.
2. Log into vSphere client.
3. Click the **Host and Cluster** icon.
4. Select the resource pool to install the OVA.
5. Right-click the resource pool and select **Deploy OVF Template**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-2578310ba4ad28f57f1274f41b533bd028af06f5%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

6. Select **Local file**.
7. Click **Choose files** and browse to the OVA file.
8. Click **Next**.

**Name and compute**

Assign a unique VM name and select a target location to avoid duplicate VM names, enforce the VM inherits appropriate permissions based on its folder or resource pool and place the VM in the correct location.

1. Enter a name for the virtual machine.
2. Select a **target location** for the virtual machine.
3. Click **Next**.

**Select a Compute Resource**

Select a compute resource to ensure the VM runs on a suitable host with suitable CPU, memory, and network resources.

1. Choose the **destination resource** for the virtual machine.
2. Click **Next**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-75e8a25eb670ffbe75c11788201085fc2572fce2%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

**Template review and storage**

1. Review details and verify minimum requirements:

| CPU    | Quad-core |
| ------ | --------- |
| Memory | 8 GB      |
| Disk   | 150 GB    |

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FmkO2WvRxDeYsuEuRB1Ne%2Fimage.png?alt=media&#x26;token=be4da6b9-9afc-4465-926b-bf2987203476" alt=""><figcaption></figcaption></figure>

2. Click **Next**.
3. Review details and verify minimum requirements:
4. Click **Next**.
5. Select virtual disk format:

   1. **Eager Zeroed Thick**: Allocates storage and clears all disk array data immediately.
   2. **Thin Provision**: Allocates storage and clears disk array data only on demand.
   3. **Lazy Zeroed Thick**: Allocates storage immediately but clears disk array data only on demand.

   <figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-b761559a0f7cbe7732b2da89b8515029f4174a9d%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>
6. Select **VM Storage Policy** from the drop-down.
7. Select a **datastore** to deploy the virtual machine.
8. Click **Next**.

**Network mapping and finish**

1. In **Destination Network**, select the network for Logpoint.
2. Click **Next**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-8d64ffe170fea641419f7ad72081e9d851b994d3%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

**Review Configuration**

1. **Review** your configurations before creating a virtual machine.
2. Click **Finish** to create the virtual machine.
3. To make any changes, click **Back**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-1d2b43f01c639b8e3ca529c6dd8a90cec6e290d4%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

**Verify access (DHCP or Static)**

You can connect to Logpoint in:

1. **DHCP Mode** to automatically configure configures the IP address, subnet mask, default gateway and DNS server information from a DHCP server.
2. **Static Mode** to configure your connection to Logpoint manually.

**Connect Using DHCP mode**

1. Select your virtual machine.
2. Go to **Actions >> Power >> Power On**. Use the green power arrow (![](https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2F1lirZbgjhwOfn5rS0lcI%2Fimage.png?alt=media\&token=99879bd1-0034-4971-8b9c-49da0aac55a9)) to turn the machine on.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FNBtl6nUBcOdx9BbLV7yb%2Fimage.png?alt=media&#x26;token=f375ca3d-4027-44c0-a43f-175c0d188efe" alt=""><figcaption></figcaption></figure>

1. Note the **IP addresses** under **Summary.**
2. Enter the IP addresses as URLs on a web browser. *For Example: <https://10.45.3.64>*
3. Log in with:

```
Username: admin
Password: changeme
```

6. [Change your password](https://docs.logpoint.com/siem/product-docs/user-configuration#change-user-password).

**Connect Using Static mode**

1. Select the required virtual machine.
2. Go to **Actions >> Power >> Power On**.
3. Click **Launch Console**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FBvbE3pnhyiRr0LSMUxl7%2Fimage.png?alt=media&#x26;token=76576767-d3a3-4521-be4f-d0b1d7b4a926" alt=""><figcaption></figcaption></figure>

4. Select **Web Console**. Click **LAUNCH**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2F4ziaz86wfosJ5WdJ5HE8%2Fimage.png?alt=media&#x26;token=6a218856-a01e-4534-9ce7-23ce6b291669" alt=""><figcaption></figcaption></figure>

5. Log in with:

```
Username: admin
Password: changeme
```

6. Run command `change-ip`.
7. Enter **HOSTNAME**. *Example: Logpoint*
8. Enter the **IP Address**. *Example: 10.45.3.64*
9. Enter **NETMASK**. *Example: 255.255.255.0*
10. Enter **GATEWAY**. *Example: 10.45.9.1*
11. Enter **PRIMARY DNS**. *Example: 10.0.3.2*
12. Enter **SECONDARY DNS**. (Optional) *Example: 8.8.8.8*
13. Enter **DOMAIN**. *Example: logpoint.local*

**SSH access (li-admin)**

1. Go to **Settings >> System >> System Settings**.
2. Select **SSH Key Pair for li-admin**.
3. Enter a **Pass Phrase**.
4. Click **Re-Generate Key Pair**.
5. Copy the **Private Key** and save it in a file.
6. Use the `chmod 400 <filename>` command to make the key accessible for an SSH connection. Example: `chmod 400 ~/.ssh/id_rsa`&#x20;
7. Use the `ssh -i "<filename>" li-admin@<Logpoint_Server_IP>` command.

   Example: `ssh -i ~/.ssh/id_rsa li-admin@<LogpointServerIP>`
8. Enter the **Pass Phrase** to establish the SSH connection from the remote device.

</details>

<details>

<summary>Amazon Machine Image (AMI)</summary>

Logpoint AMIs are used to deploy on AWS. It provides:

1. **Scalable computing** allows you to manage the computing configuration of the Logpoint instances and make real-time adjustments without investing in separate hardware.
2. **Complete control over security** lets you configure the ports, source IPs, and protocols that can access the Logpoint instances, ensuring a high level of security.
3. **Flexible configuration** lets you adjust the parameters such as storage, memory, CPU, and networking capacity without any hassle.
4. **Virtual Private Cloud** (VPC) allows you to create a logically isolated instance separated from the rest of the AWS cloud and connect it to the network only when required.

**Obtaining Logpoint AMI**

Contact the Logpoint Support team and provide your AWS Account Number and Deployment Region to receive Logpoint AMI. Logpoint can share AMIs within the following AWS regions: **us-east-1**, **eu-west-1**, **ec-central-1**, and **ap-south-1.**

1. Log in to the AWS management console.
2. Click the **Support** drop-down and select **Support Center**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FhMQymOUZbmu17qrcFyx7%2Fimage.png?alt=media&#x26;token=376f277b-3120-4b23-a943-17c73358e769" alt=""><figcaption></figcaption></figure>

3. Note down the **Account number** at the top of the **Support Center** page.

**Selecting the Deployment Region**

1. Log in to the AWS management console.
2. In the top right drop-down, select the **Region** to deploy the instance.

<figure><img src="broken-reference" alt=""><figcaption></figcaption></figure>

3. Note down the selected **Region**.

**Enabling EBS Encryption and launching from EBS-encrypted AMI**\
To launch the Logpoint instances securely in the AWS environment, we recommend you enable EBS encryption and launch all instances from the EBS-encrypted AMI, including the root volume.&#x20;

For enhanced security, we recommend you implement [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html). To transition from IMDSv1 to IMDSv2, follow the [AWS Documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html).

1. Log into the AWS management console.
2. Go to **Services >> EC2** and select **AMIs** under **Images**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FkTNa3fJkMRlH4hyXqjOT%2Fimage.png?alt=media&#x26;token=8a0468b8-57ac-4b6a-9a80-062a452c5157" alt="" width="121"><figcaption></figcaption></figure>

3. Select **Private Images** from the drop-down.
4. Select the **Logpoint** AMI and click **Copy AMI** from the **Actions** drop-down.
5. Select the **Destination Region**.
6. Enter the **Name** and **Description** for the encrypted AMI.
7. Select **Encryption** and select the **Master Key** for encryption.
8. Once you are redirected to the **AMIs** page, select the **Owned by me** from the drop-down.
9. Select the copied AMI and click **Launch**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FYubFplqXwIJUAnLmm00v%2Fimage.png?alt=media&#x26;token=76181abb-a367-4000-b274-6c1e63e3c471" alt=""><figcaption></figcaption></figure>

**Launching instance without enabling EBS Encryption**

1. Log into the AWS management console.
2. Go to **Services >> EC2** and select **AMIs** under **Images**.
3. Select **Private Images** from the drop-down.
4. Select the **Logpoint** AMI and click **Launch**.

**Launching instance (basic recommended settings)**

1. Choose an **Instance Type** from the list. The minimum configuration is **t2.xlarge** type with 4 CPUs and 16 GiB memory.
2. Click **Next: Configure Instance Details**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FEFFeBhpSdw3hOcx7j0IW%2Fimage.png?alt=media&#x26;token=6bb80c2c-4974-4939-9d83-c7af749277bf" alt=""><figcaption></figcaption></figure>

**Configuring Instance**

1. Enter the **Number of instances**.
2. Deselect the **Purchasing option** as it is not relevant.
3. Select a Virtual Private Cloud (VPC) **Network** to host Logpoint AMI. You can create a new VPC or select from the available ones.
4. Select the **Subnet** for your instances from the selected VPC. You can use the existing subnet or create a new one.
5. Select **Auto-assign Public IP** if you want to make your instances accessible from the Internet.
6. Select **Placement group** to launch the instances in a placement group. The placement group determines how instances are placed on the underlying hardware. All the placement groups function under one of the following strategies:

   > * **Cluster** — clusters the instances into a low-latency group in a single Availability Zone.
   > * **Spread** — spreads the instances across the underlying hardware. You can either add the instance to an existing placement group by selecting **Add to existing placement group** or create a new placement group by selecting **Add to a new placement group**.
   >   * If you select **Add to existing placement group**, choose one of the available placement groups from the drop-down.
   >   * If you select **Add to a new placement group**, add a new placement group by specifying a **Name** and **Placement group strategy**.
7. Select **Capacity Reservation**.&#x20;
8. Select a **Domain join directory** to join the Logpoint instance to a directory defined in the **AWS Directory Service**.
9. Specify the **IAM role** for the instances if required. **Identity and Access Management (IAM)** lets you specify permissions granted to each AWS resource.
10. Select **Shutdown behavior** for the instances. If you select **Stop:** the instances stop running, and **Terminate:** the instances are permanently deleted.
11. Select **Stop - Hibernate behavior** to enable hibernation in the instance.
12. **Enable termination protection** to receive a confirmation message before terminating the instances.
13. Select **Monitoring** to analyze instance metrics in detail using Amazon CloudWatch.

    By default, you have access to **basic monitoring**, allowing you to view metrics every five minutes. The **CloudWatch detailed monitoring** allows you to view the metrics in the one-minute interval.
14. Select a **Tenancy** infrastructure to run your instances.
15. Select **Add an Elastic Inference accelerator** to enable cost-efficient hardware acceleration.
16. Select **Unlimited** credit specification to allow the Logpoint instances to exceed the CPU utilization baseline whenever required.
17. Specify Amazon EFS **File systems** to mount to the Logpoint instance.
18. Leave the **Network interfaces** and **Advanced Details** settings as they are.
19. Click **Next: Add Storage**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2F2RDCPtdPZPepp9ta2OBG%2Fimage.png?alt=media&#x26;token=43a388dc-408a-4d2e-af8c-f89db4d569d0" alt=""><figcaption></figcaption></figure>

**Adding Storage**

1. Specify the storage device settings to launch the instance. Enter **150 GiB** volume to install and run a Logpoint instance.
2. Click **Next: Add Tags**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FdHRXQAMXdHPKVZ3UAP3d%2Fimage.png?alt=media&#x26;token=6a29b2b8-8ade-4a48-8ba9-0a58ff5328f3" alt=""><figcaption></figcaption></figure>

**Adding Tags**

1. Enter the tags to be applied to the instance. The tags help you distinguish the instances and volumes when required.
2. Click **Next: Configure Security Group**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FjXtwVb6qD3DAGvu28J8Q%2Fimage.png?alt=media&#x26;token=de2c6635-4d3d-476b-9eb5-9ecb496f067b" alt=""><figcaption></figcaption></figure>

**Configuring Security Groups**

We recommend opening the required ports in the network Access Control List (ACL) and configure security groups to launch Logpoint instances securely.

1. In the *Configure Security Group*, select **Create a new security group** to set all the firewall rules that control the traffic for your Logpoint instances.

| Port                | Protocol | Service                  |
| ------------------- | -------- | ------------------------ |
| 514                 | TCP      | Syslog Collector         |
| 6514                | TCP      | Syslog Collector SSL     |
| 6161                | TCP/UDP  | Snare Collector          |
| 6162                | TCP/UDP  | Snare Collector          |
| 6343                | UDP      | SFlow Collector          |
| 21                  | TCP      | FTP                      |
| 162                 | TCP      | SNMP Trap Collector      |
| 443                 | TCP      | Web Service              |
| 9001                | UDP      | EMC Collector            |
| 7996/7997/7998/7999 | TCP      | Logpoint Agent Collector |

2. Click **Review and Launch**.

![](https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fjt9LEDIZkx9lNdfoDq8x%2Fimage.png?alt=media\&token=00d19c58-b9e1-4b66-a838-cfe936c4e535)<br>

**Obtaining a Key Pair**\
After you click **Launch**, a key pair is required to establish an SSH connection with Logpoint. To obtain a key pair, you can either **Choose an existing key pair** or **Create a new key pair** from the drop-down menu.

If you choose to **Create a new key pair**,

1. Enter a **Key pair name**.
2. Click **Download Key Pair**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FUNwmwSFvBOoNTNCAkIWI%2Fimage.png?alt=media&#x26;token=cd0e9cdf-b520-4a59-bf2b-0b5a54f8e894" alt=""><figcaption></figcaption></figure>

3. Click **Launch Instances**.

If you **Choose an existing key pair**,

1. **Select a key pair** from the list of the available key pairs.
2. Read the confirmation message and agree with the terms.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Faof9JBQIQNaLt55ONgP8%2Fimage.png?alt=media&#x26;token=b87d026c-3c4a-44a7-be78-51802fe4ef67" alt=""><figcaption></figcaption></figure>

3. Click **Launch Instances**.

**Verify Access**

1. Go to **Services >> EC2 >> Instances**.

2. Select the Logpoint instance from the list of available instances.

3. Go to the **Networking** tab and note the **Public IPv4 address** and the **Instance ID**. The public IP works as the URL to access your Logpoint from the user interface and to establish an SSH connection from remote devices.

4. Enter the public IP address in a web browser.

5. Log into the user interface using the following credentials.

   ```
   https://<Public_IP>
   Username: admin
   Password: <Instance ID>
   ```

6. We recommend you set the Public IP of the instance as the **Server Alias** after you log in. Go to **Settings >> System >> System Settings >> General** to set the Server Alias.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fr8qmvRyWiiWrOSs8gVeX%2Fimage.png?alt=media&#x26;token=cdc0d9fb-eccf-496a-af4a-710e5b749639" alt=""><figcaption></figcaption></figure>

\
**Connecting the Instance with the Provided key-value pair**

To establish an SSH connection for the li-admin user:

1. Open the command prompt.
2. Locate the downloaded key pair file.
3. Use the `chmod 400 <filename>` command.

   *Example: chmod 400 Logpoint.pem*
4. Use the `ssh -i "<filename>" li-admin@<Logpoint_Server_IP>` to establish SSH connection from the remote device.

   *Example: ssh -i “Logpoint.pem” li-admin\@10.10.98.68*

</details>

<details>

<summary>VHD on Microsoft Azure</summary>

Using the Logpoint Azure VHD, you can:

1. **Azure Security Center** provides unified security management and advanced threat protection. You can apply security policies across your cloud workloads, limit your exposure to threats, and detect and respond to attacks.
2. **Azure Monitor** includes Log Analytics and Application Insights. It provides sophisticated tools for collecting and analyzing telemetry. It allows you to maximize the performance and availability of your cloud and on-premises resources and applications. It also helps you analyze the performance of your Azure applications and proactively identify issues affecting them.
3. **Azure Cost Management** provides a cost management solution that helps you monitor and control expenses and optimizes resource use. You can analyze costs, create and manage budgets, export data, and review and act on recommendations.
4. **Azure Backup and Recovery** protects the data of on-premises servers, virtual machines, and virtualized workloads. It also handles disaster recovery of these resources with on-site recovery.

**Deploy using the Logpoint Azure VHD. High-level steps:**

1. Get the Logpoint VHD (SAS URL) from Logpoint Sales.
2. Secure Azure infrastructure (use private subnets, managed disks, NSGs, encryption).
3. Deploy the Logpoint VHD: copy to storage account, create managed disk, create VM from managed disk.

**Copy VHD to your Storage Account (using CLI)**

```
az storage blob copy start --destination-blob <Name of the VHD>.vhd --destination-container <Destination Container> --account-name <Storage Account Name> --account-key <Storage Account Key> --source-uri <SAS URL of Logpoint Azure VHD>
```

**Monitor copy:**

```
az storage blob show -c <Container> -n <VHD Name> --account-name <Storage Account Name> --account-key <Storage Account Key>
```

**Copy VHD to your Storage Account (using UI)**

1. Log into the [Microsoft Azure portal](https://portal.azure.com/) and go to **Storage accounts**.
2. Click the name of your account and click **Access keys**.
3. Copy the **Storage account name** and **key1** or **key2**.

![](https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FGFjyhEmAfaM8BPsTUh3z%2Fimage.png?alt=media\&token=19a4760c-1721-4445-9b41-52473622b9e9)<br>

**Create Managed Disk from VHD (Azure Portal)**

1. Log into the [Microsoft Azure portal](https://portal.azure.com/) and go to **All services**.
2. Search for **Disks** and select the service and click **Create**.

**Basics**

1. Select a **Subscription** method and a **Resource Group**.&#x20;
2. Enter a **Disk name**.
3. Select the **Region** to deploy your managed disk.
4. Select an **Availability zone** within the selected region to ensure high-availability of the applications and protect the data and applications from accidental data center failures. The **Availability zone** may not be available for all locations.
5. Choose a **Source type** for the managed disk. To install the Logpoint VHD,
   * Select **Storage blob** as the source type.
   * Select a **Source subscription** method.
   * In the **Source blob** option, click **Browse** to provide the location of the destination container of the previously obtained Logpoint Azure VHD.
   * Select the **Linux** OS.
6. Select the disk **Size** in GiB. The disk size should be 150 GiB (equal to the size of the source).

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FxXUP66mWHfjbnWtvoEWx%2Fimage.png?alt=media&#x26;token=602eb118-a022-48a8-91f0-3539c9575465" alt=""><figcaption></figcaption></figure>

7. Click **Next : Encryption >**.

**Encryption**

Select an **Encryption type** and click **Next: Networking >>**.

**Networking**

1. Select a **Connectivity method**.&#x20;
2. Click **Next : Advanced >**.

**Advanced**

1. **Enable shared disk** to allow the managed disk to be attached to two or more virtual machines.
2. click **Next : Tags >**.

**Tags**

1. Enter the **Tags** for the resources. Tags are the name-value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple resources and resource groups.
2. Click **Next : Review + create >**.

**Review + create**

The **Review + create** tab displays all the data entered in the previous pages. Click **Previous** before finalizing the configuration if necessary.

Click **Create** to create the managed disk.

**Create VM from Managed Disk**

1. Go to **All Services >> Disks**,  select managed disk and **create VM**.
2. Select  **Subscription** and **Resource group** (must match disk).&#x20;
3. Enter a **VM name**.&#x20;
4. Select the **Availability options** to manage the availability, recovery, and backup of the virtual machine. It protects your data and applications from data center outages and maintenance events.
5. The **Image** represents the base application for the virtual machine. In this case, it is the disk containing the **Logpoint VHD**.
6. Select a VM **Size**  (minimum quad-core, 8 GB, 150 GB).
7. Select the required network ports accessible from the internet in the **Public inbound ports** option.
8. Click **Next : Disks >**.
9. Select an **Encryption type**.
10. Configure additional data disks for your virtual machine. You can **create and attach a new disk** or **attach an existing disk**.
11. Click **Next: Networking >**.
12. Select the **Virtual network** for your virtual machine. Virtual networks create logical isolation in Azure. Each virtual network has their IP addresses range, subnets, route tables, gateways, and security settings.
13. Select the **Subnet** range for your virtual network.
14. Select the **Public IP** to access your virtual machine from the internet. (None recommended)
15. Select **Advanced** in the **NIC network security group**.
16. **Configure network security group** with required ports.
17. Select **Place this virtual machine behind an existing load balancing solution** to provide an existing Azure load balancing solution to the VM.
18. Click **Next : Management >**.
19. In **Monitoring**,
    * Enable **Boot diagnostics** to capture serial console output and screenshots of the virtual machine. It helps to diagnose startup issues.
    * Enable **OS guest diagnostics** to get the metrics of the virtual machine every minute.
    * If you enable boot diagnostics with a custom storage account, select a **Diagnostics storage account** to store the metrics data.
20. In **Identity**, select **System assigned managed identity** to grant or receive permissions via Azure role-based access control.
21. In **Auto-Shutdown**, **Enable auto-shutdown** to shut down the virtual machines daily automatically.
22. Click **Next : Advanced>**.
23. Select the **Extensions** for the resources if needed.
24. In **Custom data**, enter a script, configuration file, or other data into the VM while it is being provisioned.
25. **Enable User data** to enter a script, configuration file, or other data.
26. Select a desired **Host group** or a **Proximity placement group** to group your VMs.
27. Click **Next : Tags>**.
28. Enter the **Tags** for the resources. Tags are the name-value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple resources and resource groups.
29. Click **Next : Review + create >**.
30. The **Review + create** tab displays all the data entered in the previous pages. Click **Previous** before finalizing the configuration if necessary.

    Click **Create** to launch the virtual machine.

Recommended NSG ports (same as AMI list, plus 21/22 for data transfer in runtime)

**Verify Access to Azure VHD**

1. Go to **All services >> Virtual machines**.
2. Select the required **Virtual machine**.
3. In **Overview**, note down the **Subscription ID**. The Subscription ID is the password for the default user for accessing the Logpoint user interface.
4. Select **Networking** from the sidebar.
5. Note down the **NIC Private IP**. The IP address works as the URL to access your Logpoint user interface and to establish an SSH connection from remote devices. We recommend you to change the private IP address of the deployed Logpoint instance directly from the Azure Portal. If you change the IP address using the *`change-ip`* command, make sure it matches the NIC private IP address in the Azure portal.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2F81Uizbw1pcWDcDy1QmCj%2Fimage.png?alt=media&#x26;token=591b1eee-f7a7-41a3-a8d1-6299ba3fe568" alt=""><figcaption></figcaption></figure>

1. Enter the **NIC Private IP** in a web browser.
2. Log into the user interface using the following credentials.

```
https://<NIC_Private_IP>
Username: admin
Password: <Subscription ID>
```

**SSH access:**

1. Go to **Settings >> System >> System Settings**.
2. Select **SSH Key Pair for li-admin**.
3. Enter a **Pass Phrase**.
4. Click **Re-Generate Key Pair**.
5. Copy the **Private Key** and save it in a file.
6. Use the `chmod 400 <filename>` command to make the key accessible for an SSH connection. Example: `chmod 400 ~/.ssh/id_rsa`&#x20;
7. Use the `ssh -i "<filename>" li-admin@<Logpoint_Server_IP>` command.

   Example: `ssh -i ~/.ssh/id_rsa li-admin@<LogpointServerIP>`
8. Enter the **Pass Phrase** to establish the SSH connection from the remote device.

<pre><code><strong>chmod 400 ~/.ssh/id_rsa
</strong>ssh -i ~/.ssh/id_rsa li-admin@&#x3C;LogpointServerIP>
</code></pre>

</details>

<details>

<summary>Virtual Hard Disk (VHD) on Microsoft Hyper-V Server 2016 or later</summary>

Using the Logpoint Hyper-V VHD, you can:

* **Expandable private cloud environment**: It provides flexible, on-demand IT services allowing you to make adjustments on resources as per change in requirements.
* **Efficient hardware usage**: It consolidates the servers dividing the workloads equally and uses powerful physical computers decreasing the power consumption and physical space.
* **Improve business continuity**: It minimizes the impact of both scheduled and unscheduled downtime of your workloads.
* **Expandable virtual desktop infrastructure (VDI)**: It uses a centralized desktop strategy with VDI to increase business agility and data security, as well as simplify regulatory compliance and manage applications.

Requirements:

| CPU    | Quad-core |
| ------ | --------- |
| Memory | 8 GB      |
| Disk   | 150 GB    |

{% hint style="success" %}

* Launch only one Logpoint instance from a single VHD. For multiple instances, create copies of the original VHD.
* Keep original VHD as backup; launch from copies.
* Hyper-V VHD is dynamically expanding; you can convert to fixed-size VHD via Edit Disk.
  {% endhint %}

Deployment methods: Hyper-V Manager (GUI) or Windows PowerShell.

Deploy using Hyper-V Manager (wizard)

1. Open Hyper-V Manager → select Hyper-V server → Actions → New → Virtual Machine.
2. Wizard: set Name and Location (separate folder recommended) → Next.
3. Select Generation 1 → Next.
4. Assign Startup memory (minimum 8 GB), optionally Dynamic Memory → Next.
5. Network: select virtual switch → Next.
6. Connect virtual hard disk: Use an existing virtual hard disk → browse to Logpoint VHD → Next.
7. Review summary → Finish.
8. Start VM in Hyper-V Manager → Right-click VM → Start → Connect → Login.

Deploy using PowerShell (on Hyper-V server) Run as administrator:

```
New-VM -Name <VM_Name> -MemoryStartupBytes 8GB -BootDevice VHD -VHDPath "<the_LogpointVHD_path>" -Path "<destination_path_for_the_VM>" -Generation 1 -Switch <virtual_switch_name>
```

Initial credentials and access

* Console login (li-admin):

```
Username: li-admin
Password: changeme
```

* Change password:

```
passwd
```

* View IP:

```
ifconfig
```

or in PowerShell on Hyper-V server:

```
Get-VM -VMName <virtual_machine_name> | Get-VMNetworkAdapter | Select IPAddresses
```

* GUI login:

```
https://<IP>
Username: admin
Password: changeme
```

</details>

## Configure the Logpoint Instance or Server

When you first log in, configure the Logpoint instance/server as one of:

* Standard or Compliance instance
* Advanced Configuration
  * Custom Configuration
  * Collector
  * Syslog Forwarder

### Standard or Compliance

Standard Configuration enables a quick start with preconfigured dashboards and repositories for access management, incident management, and perimeter security monitoring. Dashboards come with ready-to-use widgets for compliance, and the repositories are mapped to specific source types, such as firewalls and servers, which you can use when creating a log source.

1. Log into Logpoint.
2. Select **Standard Configuration** and click **Get started**.
3. Choose **Yes** to use pre-configured dashboards (then select repos per widget) or **No** to proceed without dashboards (repos created).
4. You are redirected to **Log Sources** page to add log sources and map to repositories.

### Advanced Configuration

#### Custom Configuration

Custom Configuration has complete features without any preconfigured dashboards or repositories. You can configure it according to your specific needs and preferences.

1. Log into Logpoint.
2. Click **Advanced Configuration** dropdown and select **Custom Configuration.**
3. Click **Get started** and **Confirm**.
4. Configure dashboards, repositories, and other settings manually.

#### Collector

Collector collects logs from different sources, normalizes them using the signatures applied, and forwards them to a configured remote Logpoint. It can enable buffering to persist locally during network outages. You can convert Logpoint to Logpoint Collector during login or configure later from **Settings >> System Settings**.&#x20;

1. Log into Logpoint.
2. Click **Advanced Configuration** dropdown and select **Collector.**
3. Click **Get started**.
4. Select **Enable buffering** to store the data in local persistence during a network outage.
5. Click **Confirm**.

#### Syslog Forwarder

Syslog Forwarder collects logs from different sources, normalizes them using the signatures applied, and forwards them to a configured Logpoints and a target storage. You can convert Logpoint to a syslog forwarder during login or configure later from **Settings >> System Settings**.

1. Log into Logpoint.
2. Click **Advanced Configuration** dropdown.
3. Select **Syslog Forwarder**.
4. Click **Get started** and click **Confirm**.

<details>

<summary>Configuring Network Interfaces</summary>

1. Select the relevant interface.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FTBIeKTPL8SbZ8rYm1wKS%2Fimage.png?alt=media&#x26;token=d415b0a6-4de1-4c93-9f91-b9f9adb44881" alt=""><figcaption></figcaption></figure>

2. Select **Edit IPv4**.
3. Choose Method:
   * **Automatic (DHCP)** — settings are auto-set.
   * **Manual** — enter Subnet, Address, Gateway, Name servers, Search domains.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FFrFbeAweJKoyUeV1pipv%2Fimage.png?alt=media&#x26;token=e362b782-05a2-423c-b976-310c1ce22b6c" alt=""><figcaption></figcaption></figure>

2. Click **Save**.

</details>

<details>

<summary>Customizing Storage Partitions during installation</summary>

1. In **Storage Configuration**, select **Reset**.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FmgexD6NPcrfplZXQBpCC%2Fimage.png?alt=media&#x26;token=0f8411b6-99d6-499f-8732-eb7405be2910" alt=""><figcaption></figcaption></figure>

2. Select **Use As Boot Device** for the device to install Logpoint.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FpjxtB9Yd63tvGlU3BI5h%2Fimage.png?alt=media&#x26;token=21ca8d94-7cb8-4b72-8dc3-86cb4c426a08" alt=""><figcaption></figcaption></figure>

3. Click **Add GPT Partition** for available device, specify Size (recommend at least 8GB).&#x20;
4. Select **swap** in **Format** and select **Create**.
5. Add another **GPT Partition** for remaining storage.
6. Select **Leave unformatted** in **Format** and select **Create**. This unformatted partition can be used to hold the logical volume group.
7. Click **Create Volume Group (LVM).**
8. Enter a a **Name**, **Size**, **Format**, and **Mount** point for the new logical volume.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FwMrIiqbfg9DY2eu38kBm%2Fimage.png?alt=media&#x26;token=1d3326d5-7089-4024-aaea-a3ca1326a4e4" alt=""><figcaption></figcaption></figure>

Required logical volumes before installation:

| Name        | Mount point            | Minimum size |
| ----------- | ---------------------- | ------------ |
| boot        | /boot                  | 1GB          |
| root        | /                      | 40GB         |
| application | /opt                   | 20GB         |
| app\_store  | /opt/immune/app\_store | 20GB         |
| storage     | /opt/immune/storage    | 60GB         |

The installer auto-provides the names and mount points for the default volume group every time you select Create Logical Volume.

9. Click Done after configuring logical volumes.

</details>
