Preparation work and deployment

This section describes how to prepare your infrastructure for the Kaspersky Next XDR Expert deployment, set the installation parameters that are specific for the distributed or single node deployment, as well as how to use the Configuration wizard to generate the configuration file.

You can learn how to install Kaspersky Next XDR Expert according to the distributed and single node deployment schemes. Also, this section contains information on how to deploy multiple Kubernetes clusters with Kaspersky Next XDR Expert instances and switch between them by using KDT.

Preparing the administrator and target hosts

The administrator host is used to deploy and manage the Kubernetes cluster and Kaspersky Next XDR Expert. The target hosts are included in the Kubernetes cluster and perform the workload of the Kaspersky Next XDR Expert components. Kaspersky Next XDR Expert is deployed on the target hosts by using KDT. KDT runs on the administrator host and connects to target hosts via SSH.

Before installing Kaspersky Next XDR Expert, we recommend that you run the following command on the administrator and target hosts:
apt update

Preparing the administrator host

To prepare the administrator host:

1. Prepare a device that will act as an administrator host from which KDT will launch.

   The administrator host will not be included in the Kubernetes cluster that is created by KDT during the deployment.

   Make sure that the hardware and software on the administrator host meet the requirements for KDT.

   On the administrator host, allocate at least 10 GB of free space in the temporary files directory (/tmp) for KDT. If you do not have enough free space in this directory, run the following command to specify the path to another directory:

   export TMPDIR=<new_directory>/tmp

2. Install the package for Docker version 20 or later, and then perform post-installation steps to configure the administration host for proper functioning with Docker.

Preparing the target hosts

To prepare the target hosts:

1. Prepare the physical or virtual machines on which Kaspersky Next XDR Expert will be deployed.

   A minimum cluster configuration for the distributed deployment includes four nodes:

   • One primary node

     The primary node is intended for managing the cluster, storing metadata, and distributing of the workload.

   • Three worker nodes

     The worker nodes are intended for performing the workload of the Kaspersky Next XDR Expert components.

     For optimal allocation of computing resources, it is recommended to use nodes with the same resources.

     You can install the DBMS inside the Kubernetes cluster when you perform the demonstration deployment of Kaspersky Next XDR Expert. In this case, allocate the additional worker node for the DBMS installation. KDT will install the DBMS during the Kaspersky Next XDR Expert deployment.

     For the distributed deployment, we recommend installing a DBMS on a separate server outside the cluster.
     After you deploy Kaspersky Next XDR Expert, changing the DBMS installed inside the cluster to a DBMS installed on a separate server is not available. You have to remove all Kaspersky Next XDR Expert components, and then install Kaspersky Next XDR Expert again. In this case, the data will be lost.

   A minimum cluster configuration for the single node deployment includes one target host, which acts as the primary and worker nodes. On this primary/worker node, the Kubernetes cluster and Kaspersky Next XDR Expert components are installed.

   Make sure that the hardware and software on the target hosts meet the requirements for the selected deployment option (the distributed or single node deployment), and the target hosts are located in the same broadcast domain.

   For proper functioning of Kaspersky Next XDR Expert the Linux kernel version must be 5.15.0.107 or later on the target hosts with the Ubuntu family operating systems

   Do not install Docker on the selected target hosts. KDT will install all necessary software and dependencies during the deployment.

2. On each target host, install the sudo package, if this package is not already installed. For Debian family operating systems, install the UFW package on the target hosts.
3. On each target host, configure the /etc/environment file, if your organization's infrastructure uses the proxy server to access the internet, as well as you need to connect the target hosts to the internet.
4. On the primary node with the UFW configuration, allow IP forwarding. In the /etc/default/ufw file, set DEFAULT_FORWARD_POLICY to ACCEPT.
5. Provide access to the package repository where the packages required for the function of Kaspersky Next XDR Expert are located:
   • nfs-common
   • tar
   • iscsi-package
   • wireguard
   • wireguard-tools

   KDT will try to install these packages during the deployment from the package repository. You can also install these packages manually.

6. Ensure that the curl package is installed on the primary node (or on the primary/worker node, if you perform the single node deployment).
7. Ensure that the libnfs12 package is installed on the worker nodes (or on the primary/worker node, if you perform the single node deployment).

   The curl and libnfs12 packages are not installed during the deployment from the package repository by using KDT. You must install these packages manually if they are not already installed.

8. Reserve static IP addresses for the target hosts, for the Kubernetes cluster gateway, and for the DBMS (if the DBMS is installed inside the cluster).

   The Kubernetes cluster gateway is intended for connecting to the Kaspersky Next XDR Expert components installed inside the Kubernetes cluster.

9. On your DNS server, register the domain names to connect to the Kaspersky Next XDR Expert services.

   By default, the Kaspersky Next XDR Expert services are available at the following addresses:

   • console.<smp_domain>—Access to the OSMP Console functionality.
   • admsrv.<smp_domain>—Access to the Administration Server functionality.
   • kuma.<smp_domain>—Access to the KUMA functionality.
   • api.<smp_domain>—Access to the Kaspersky Next XDR Expert API functionality.
   • psql.<smp_domain>—Interaction with the DBMS (PostgreSQL).

     Register the psql.<smp_domain> domain name if you installed the DBMS inside the Kubernetes cluster on the DBMS node and you need to connect to the DBMS.

   The listed domain names must correspond to the IP address of the Kubernetes cluster gateway. If you install the DBMS inside the cluster, the gateway IP address is an IP range. The first IP address of the range is the address of the Kaspersky Next XDR Expert services (excluding the DBMS IP address), and the second IP address of the range is the DBMS IP address.

10. On the target hosts, create user accounts that will be used for the Kaspersky Next XDR Expert deployment.

    These accounts are used for the SSH connection and must be able to elevate privileges (sudo) without entering a password. To do this, add the created user accounts to the /etc/sudoers file.

11. Configure the SSH connection between the administrator and target hosts:
    1. On the administrator host, generate SSH keys by using the ssh-keygen utility.
    2. After you generate a pair of SSH keys, copy the public key to every target host (for example, to the /home/<user_name>/.ssh directory).
12. For proper function of the Kaspersky Next XDR Expert components, provide network access between the target hosts and open the required ports on the firewall of the administrator and target hosts, if necessary.
13. Configure time synchronization over Network Time Protocol (NTP) on the administrator and target hosts.
14. If necessary, prepare custom certificates for working with Kaspersky Next XDR Expert public services.

    You can use one intermediate certificate that is issued off the organization's root certificate or leaf certificates for each of the services. The prepared custom certificates will be used instead of a self-signed certificates.

Preparing the hosts for installation of the KUMA services

The KUMA services (collectors, correlators, and storages) are installed on the KUMA target hosts that are located outside the Kubernetes cluster.

To prepare the KUMA target hosts for installation of the KUMA services:

1. Ensure that hardware, software, and installation requirements are met.
2. Specify the host names.

   We recommend specifying the FQDN, for example: kuma1.example.com.

   We do not recommend changing the KUMA host name after installation. This will make it impossible to verify the authenticity of certificates and will disrupt the network communication between the application components.

3. Configure the SSH connection between the administrator host and hosts on which the KUMA services will be installed.

   You can use the SSH keys created for the target hosts. Alternatively, you can generate new SSH keys by using the ssh-keygen utility:

   1. On the administrator host, generate SSH keys by using the ssh-keygen utility without a passphrase.
   2. Copy the public key to hosts on which the KUMA services will be installed by using the ssh-copy-id utility.
4. Register the KUMA target hosts in your organization's DNS zone to allow host names to be translated to IP addresses.
5. To get the hostname that you must specify in the KUMA inventory file, run the following command:

   hostname -f

   The prepared hosts must provide access for the administrator host by the hostname.

The hosts are ready for installation of the KUMA services.

Installing a database management system

Kaspersky Next XDR Expert supports PostgreSQL or Postgres Pro database management systems (DBMS). For the full list of supported DBMSs, refer to the Hardware and software requirements.

Each of the following Kaspersky Next XDR Expert components requires a database:

• Administration Server
• Automation Platform
• Incident Response Platform (IRP)
• Identity and Access Manager (IAM)

Each of the components must have a separate database within the same instance of DBMS. We recommend that you install the DBMS instance outside the Kubernetes cluster.

For the DBMS installation, KDT requires a privileged DBMS account that has permissions to create databases and other DBMS accounts. KDT uses this privileged DBMS account to create the databases and other DBMS accounts required for the Kaspersky Next XDR Expert components.

For information about how to install the selected DBMS, refer to its documentation.

After you install the DBMS, you need to configure the DBMS server parameters to optimize the DBMS work with Open Single Management Platform.

Configuring the PostgreSQL or Postgres Pro server for working with Open Single Management Platform

Kaspersky Next XDR Expert supports PostgreSQL or Postgres Pro database management systems (DBMS). For the full list of supported DBMSs, refer to the Hardware and software requirements. Consider configuring the DBMS server parameters to optimize the DBMS work with Administration Server.

The default path to the configuration file is: /etc/postgresql/<VERSION>/main/postgresql.conf

Recommended parameters for PostgreSQL and Postgres Pro DBMS for work with Administration Server:

• shared_buffers = 25% of the RAM value of the device where the DBMS is installed

  If RAM is less than 1 GB, then leave the default value.

• max_stack_depth = If the DBMS is installed on a Linux device: maximum stack size (execute the 'ulimit -s' command to obtain this value in KB) minus the 1 MB safety margin

  If the DBMS is installed on a Windows device, then leave the default value 2 MB.

• temp_buffers = 24MB
• work_mem = 16MB
• max_connections = 151
• max_parallel_workers_per_gather = 0
• maintenance_work_mem = 128 MB

Restart or reload the server after updating the postgresql.conf file to apply changes. Refer to the PostgreSQL documentation for details.

Refer to the following topic for details on how to create and configure accounts for PostgreSQL and Postgres Pro: Configuring accounts for work with PostgreSQL and Postgres Pro.

For detailed information about PostgreSQL and Postgres Pro server parameters and on how to specify the parameters, refer to the corresponding DBMS documentation.

Preparing the KUMA inventory file

Expand all | Collapse all

The KUMA inventory file is a file in the YAML format that contains installation parameters for deployment of the KUMA services that are not included in the Kubernetes cluster. The path to the KUMA inventory file is included in the configuration file that is used by Kaspersky Deployment Toolkit for the Kaspersky Next XDR Expert deployment.

The templates of the KUMA inventory file are located in the distribution package. If you want to install the KUMA services (storage, collector, and correlator) on one host, use the single.inventory.yaml file. To install the services on several hosts in the network infrastructure, use the distributed.inventory.yaml file.

We recommend backing up the KUMA inventory file that you used to install the KUMA services. You can use it to remove KUMA.

To prepare the KUMA inventory file,

Open the KUMA inventory file template located in the distribution package, and then edit the variables in the inventory file.

The KUMA inventory file contains the following blocks:

• all block

  The all block contains the variables that are applied to all hosts specified in the inventory file. The variables are located in the vars section.

• kuma block

  The kuma block contains the variables that are applied to hosts on which the KUMA services will be installed. These hosts are listed in the kuma block in the children section. The variables are located in the vars section.

The following table lists possible variables, their descriptions, possible values, and blocks of the KUMA inventory file where these variables can be located.

List of possible variables in the vars section

Sample of the KUMA inventory file template for installation of the KUMA services on a single host (the single.inventory.yaml file)

Sample of the KUMA inventory file template for installation of the KUMA services on several hosts (the distributed.inventory.yaml file)

Distributed deployment: Specifying the installation parameters

Expand all | Collapse all

The configuration file is a file in the YAML format and contains a set of installation parameters for the Kaspersky Next XDR Expert components.

The installation parameters listed in the tables below are required for the distributed deployment of Kaspersky Next XDR Expert. To deploy Kaspersky Next XDR Expert on a single node, use the configuration file that contains the installation parameters specific for the single node deployment.

The template of the configuration file (smp_param.yaml.template) is located in the distribution package in the archive with the KDT utility. You can fill out the configuration file template manually; or use the Configuration wizard to specify the installation parameters that are required for the Kaspersky Next XDR Expert deployment, and then generate the configuration file.

For correct function of KDT with the configuration file, enter an empty line at the end of the file.

The nodes section of the configuration file contains the target host parameters that are listed in the table below.

Installation parameters of the nodes section

The parameters section of the configuration file contains the parameters listed in the table below.

Installation parameters of the parameters section

Sample of the configuration file for the distributed deployment of Kaspersky Next XDR Expert

Distributed deployment: Installing Kaspersky Next XDR Expert

Kaspersky Deployment Toolkit deploys Kaspersky Next XDR Expert by using the configuration file. KDT automatically deploys the Kubernetes cluster within which the Kaspersky Next XDR Expert components and other infrastructure components are installed.

If you need to install multiple Kubernetes clusters with Kaspersky Next XDR Expert instances, you can use the required number of contexts.

To install Kaspersky Next XDR Expert:

1. Unpack the downloaded distribution package with KDT on the administrator host.
2. Read the End User License Agreement (EULA) of KDT located in the distribution package with the Kaspersky Next XDR Expert components.

   When you start using KDT, you accept the terms of the EULA of KDT.

   You can read the EULA of KDT after the deployment of Kaspersky Next XDR Expert. The file is located in the /home/kdt/ directory of the user who runs the deployment of Kaspersky Next XDR Expert.

3. On the administrator host, run the following commands to start deployment of Kaspersky Next XDR Expert. Specify the path to the the transport archive with the Kaspersky Next XDR Expert components and the path to the configuration file that you filled out earlier.

   chmod +x kdt

   ./kdt apply -k <path_to_transport_archive> -i <path_to_configuration_file>

   You can install Kaspersky Next XDR Expert without prompting to read the terms of the EULA and the Privacy Policy of OSMP if you use the --accept-eula flag. You can read the EULA and the Privacy Policy of OSMP before the deployment of Kaspersky Next XDR Expert. The files are located in the distribution package with the Kaspersky Next XDR Expert components.

   If you want to read and accept the terms of the EULA and the Privacy Policy during the deployment, do not use the --accept-eula flag.

4. If you do not use the --accept-eula flag in the previous step, read the EULA and the Privacy Policy of OSMP. The text is displayed in the command line window. Press the space bar to view the next text segment. Then, when prompted, enter the following values:
   1. Enter y if you understand and accept the terms of the EULA.

      Enter n if you do not accept the terms of the EULA. To use Kaspersky Next XDR Expert, you must accept the terms of the EULA.

   2. Enter y if you understand and accept the terms of the Privacy Policy, and you agree that your data will be handled and transmitted (including to third countries) as described in the Privacy Policy.

      Enter n if you do not accept the terms of the Privacy Policy.

      To use Kaspersky Next XDR Expert, you must accept the terms of the EULA and the Privacy Policy.

   After you accept the EULA and the Privacy Policy, KDT deploys the Kaspersky Next XDR Expert components within the Kubernetes cluster on the target hosts.

   During the Kaspersky Next XDR Expert deployment, a new user is created on the primary Administration Server. To start configuring OSMP Console, this user is assigned the following roles: the XDR role of the Main administrator in the Root tenant and the Kaspersky Security Center role of the Main administrator.

5. View the installation logs of the Bootstrap component in the directory with the KDT utility and obtain diagnostic information about Kaspersky Next XDR Expert components, if needed.
6. Sign in to the OSMP Console and to the KUMA Console.

   The default OSMP Console address is https://console.<smp_domain>:443.

   The default KUMA Console address is https://kuma.<smp_domain>:7220.

Single node deployment: Specifying the installation parameters

Expand all | Collapse all

If you want to deploy Kaspersky Next XDR Expert on a single node, fill out the installation parameters of the configuration file that are required both for the distributed and single node deployment, as well as define the following specific parameters: type, lowResources, vault_replicas, vault_ha_mode, vault_standalone, and defaultClassReplicaCount.

The template of the configuration file for the single node deployment is located in the distribution package with the Kaspersky Next XDR Expert components. You can fill out the configuration file template manually; or use the Configuration wizard to specify the installation parameters that are required for the Kaspersky Next XDR Expert deployment, and then generate the configuration file.

For correct work of KDT with the configuration file, enter an empty line at the end of the file.

The nodes section of the configuration file contains the target host parameters that are listed in the table below.

Installation parameters of the nodes section

The parameters section of the configuration file contains the parameters listed in the table below.

Installation parameters of the parameters section

Sample of the configuration file for the single node deployment of Kaspersky Next XDR Expert

Single node deployment: Installing Kaspersky Next XDR Expert

If necessary, you can perform the single node deployment of Kaspersky Next XDR Expert so that the solution requires fewer computing resources (for example, for demonstration purposes).

In this configuration, the administrator host is used to install and manage the Kubernetes cluster and Kaspersky Next XDR Expert, as with distributed deployment. KDT is launched from the administrator host.

One target host, which acts as the primary and worker nodes, manages the Kubernetes cluster, stores metadata, and performs the workload of the Kaspersky Next XDR Expert components. The Kubernetes cluster and Kaspersky Next XDR Expert components are installed on this target host. Only the target host is included in the Kubernetes cluster (the primary worker node of the cluster).

To perform the single node deployment of Kaspersky Next XDR Expert:

1. Download the distribution package that has the Kaspersky Next XDR Expert components.
2. Install a database management system.

   Skip this step if you want to install the DBMS inside the cluster. KDT will install the DBMS during the Kaspersky Next XDR Expert deployment. In this case, the Kaspersky Next XDR Expert components and the DBMS will use one target host.

   Alternatively, you can install the DBMS on a separate server outside the cluster.

3. Prepare the administrator and target hosts, as with distributed deployment.

   Make sure that the hardware and software on the target host meet the requirements for the single node deployment.

   For the target host that acts as a primary worker node, perform all preparatory steps necessary for both primary and worker nodes.

4. Prepare the KUMA target hosts for installation of the KUMA services.
5. Prepare the KUMA inventory file.
6. Fill out the configuration file manually or by using the Configuration wizard.

   The deployment method (distributed deployment or single node deployment) is determined by the installation parameters. The following installation parameters are specific to the single node deployment: type, lowResources, vault_replicas, vault_ha_mode, vault_standalone, defaultClassReplicaCount.

7. Install Kaspersky Next XDR Expert by using KDT.

The Kubernetes cluster and Kaspersky Next XDR Expert components are deployed on the primary worker node, and the KUMA services are installed.

Configuration wizard for the Kaspersky Next XDR Expert deployment

For the distributed and single node Kaspersky Next XDR Expert deployment, you have to prepare a configuration file that contains the installation parameters of the Kaspersky Next XDR Expert components. The Configuration wizard allows you to specify the installation parameters that are required to deploy Kaspersky Next XDR Expert, and then generate the resulting configuration file.

Prerequisites

Before specifying the installation parameters by using the Configuration wizard, you must do the following:

• Select the option for deploying Kaspersky Next XDR Expert.
• Download the distribution package with the Kaspersky Next XDR Expert components.
• Install a database management system on a separate server that is located outside the Kubernetes cluster, if needed (only for the distributed deployment).
• Prepare the administrator and target hosts.
• Prepare the hosts for installation of the KUMA services.
• Prepare the KUMA inventory file.

Process

To specify the installation parameters by using the Configuration wizard:

1. On the administrator host where the KDT utility is located, run the Configuration wizard by using the following command:

   ./kdt wizard -k <path_to_transport_archive> -o <path_to_configuration_file>

   where:

   • <path_to_transport_archive> is the path to the transport archive.
   • <path_to_configuration_file> is the path where you want to save the configuration file and the configuration file name.

   The Configuration wizard prompts you to specify the installation parameters. The list of the installation parameters that are specific for the distributed and single node deployment differs.

   If you do not have the Write permissions on the specified directory or a file with the same name is located in this directory, an error occurs and the wizard terminates.

2. Enter the IPv4 address of a primary node (the host parameter of the configuration file).

   If you want to perform the single node deployment, this node will act as a primary-worker node.

3. Enter the username of the user account used for connection to the primary node by KDT (the user parameter of the configuration file).
4. Enter the path to the private part of the SSH key located on the administrator host and that is used for connection to the primary node by KDT (the key parameter of the configuration file).

   The default value is /root/.ssh/id_rsa.

5. Enter the number of worker nodes.

   Possible values:

   • 0—Single node deployment.
   • 3 or more—Distributed deployment.

   This step defines the option of deploying Kaspersky Next XDR Expert. If you want to perform single node deployment, the following parameters specific for this deployment option will take the default values:

   • type—primary-worker
   • lowResources—true
   • vault_replicas—1
   • vault_ha_mode—false
   • vault_standalone—true
   • defaultClassReplicaCount—1
6. For each worker node, enter the IPv4 address (the host parameter of the configuration file).

   Note that the primary and worker nodes must be included in the same subnet.

   The kind parameter of the first worker node is set to admsrv by default. That means that Administration Server will be installed on the first worker node.

7. For each worker node, enter the username used for connection to the worker node by KDT (the user parameter of the configuration file).
8. For each worker node, enter the path to the private part of the SSH key used for connection to the worker node by KDT (the key parameter of the configuration file).

   The default value is /root/.ssh/id_rsa.

9. Enter the connection string for accessing the DBMS that is installed and configured on a separate server (the psql_dsn parameter of the configuration file).

   Specify this parameter as follows: postgres://<dbms_username>:<password>@<fqdn>:<port>.

10. Enter the reserved static IP address of the Kubernetes cluster gateway (the ipaddress parameter of the configuration file).

    The gateway must be included in the same subnet as all cluster nodes. The gateway IP address must contain the subnet mask /32.

11. Enter the username of the Kaspersky Next XDR Expert user account that will be created by KDT during the installation (the adminLogin and kumaLogin parameters of the configuration file).

    The default username of this account is "admin." The Main administrator role is assigned to this user account.

12. Enter the password of the Kaspersky Next XDR Expert user account that will be created by KDT during the installation (the kscpassword and adminPassword parameters of the configuration file).
13. Enter the path to the KUMA inventory file located on the administrator host (the inventory parameter of the configuration file).

    The KUMA inventory file contains the installation parameters for deployment of the KUMA services that are not included in the Kubernetes cluster.

14. Enter the path to the private part of the SSH key located on the administrator host and used for connection to the nodes with the KUMA services (the sshkey parameter of the configuration file).
15. Enter the path to the LICENSE file of KUMA (the license parameter of the configuration file).
16. Enter the domain name that is used in the addresses of the public Kaspersky Next XDR Expert services (the smp_domain parameter of the configuration file).
17. Enter the path to the custom certificates used to work with the public Kaspersky Next XDR Expert services (the intermediate_bundle parameter of the configuration file).

    If you want to use self-signed certificates, press Enter to skip this step.

18. Check the specified parameters that are displayed in the numbered list.

    To edit the parameter, enter the parameter number, and then specify a new parameter value. Otherwise, press Enter to continue.

19. Press Y to save a new configuration file with the specified parameters or N to stop the Configuration wizard without saving.

The configuration file with the specified parameters is saved in the YAML format.

Other installation parameters are included in the configuration file, with default values. You can edit the configuration file manually before the deployment of Kaspersky Next XDR Expert.

Configuring internet access for the target hosts

If your organization's infrastructure uses the proxy server to access the internet, as well as you need to connect the target hosts to the internet, you must add the IP address of each target host to the no_proxy variable in the /etc/environment file before the Kaspersky Next XDR Expert deployment. This allows you to establish a direct connection of the target hosts to the internet and correctly deploy Kaspersky Next XDR Expert.

To configure internet access for the target hosts:

1. On the target host, open the /etc/environment file by using a text editor. For example, the following command opens the file by using the GNU nano text editor:

   sudo nano /etc/environment

2. In the /etc/environment file, add the IP address of the target host to the no_proxy variable separated by a comma without a space.

   For example, the no_proxy variable can be initially specified as follows:

   no_proxy=localhost,127.0.0.1

   You can add the IP address of the target host (192.168.0.1) to the no_proxy variable:

   no_proxy=localhost,127.0.0.1,192.168.0.1

   Alternatively, you can specify the subnet that includes the target hosts (in CIDR notation):

   no_proxy=localhost,127.0.0.1,192.168.0.0/24

3. Save the /etc/environment file.

After you add the IP addresses in the /etc/environment file to each target host, you can continue preparing of the target hosts and further Kaspersky Next XDR Expert deployment.

Installation requirements for the KUMA services

Before installation of the KUMA services, make sure the following conditions are met:

• The KUMA service hosts satisfy the hardware and software requirements.
• The ports required for installation of the KUMA services are opened.
• The KUMA services are addressed using the fully qualified domain name (FQDN) of the host. Before you install the KUMA services, make sure that the correct host FQDN is returned in the Static hostname field. For this purpose, execute the following command:

  hostnamectl status

• Time synchronization over Network Time Protocol (NTP) is configured on all servers with KUMA services.
• Requirements for the operating system listed in the table below are met.

  Installation requirements for the operating system

Synchronizing time on machines

To configure time synchronization on machines:

1. Run the following command to install chrony:

   sudo apt install chrony

2. Configure the system time to synchronize with the NTP server:
   1. Make sure the virtual machine has internet access.

      If access is available, go to step b.

      If internet access is not available, edit the /etc/chrony.conf file. Replace 2.pool.ntp.org with the name or IP address of your organization's internal NTP server.

   2. Start the system time synchronization service by executing the following command:

      sudo systemctl enable --now chronyd

   3. Wait a few seconds, and then run the following command:

      sudo timedatectl | grep 'System clock synchronized'

      If the system time is synchronized correctly, the output will contains the line System clock synchronized: yes.

Synchronization is configured.

Installing KUMA services

Services are the main components of KUMA that help the system to manage events. Services allow you to receive events from event sources and subsequently bring them to a common form that is convenient for finding correlation, as well as for storage and manual analysis.

Service types:

• Storages are used to save events.
• Collectors are used to receive events and convert them to the KUMA format.
• Correlators are used to analyze events and search for defined patterns.
• Agents are used to receive events on remote devices and forward them to the KUMA collectors.

You must install the KUMA services only after you deploy Kaspersky Next XDR Expert. During the Kaspersky Next XDR Expert deployment, the required infrastructure is prepared: the service directories are created on the prepared hosts, and the files that are required for the service installation are added to these directories. We recommend installing services in the following order: storage, collectors, correlators, and agents.

To install and configure the KUMA services:

1. Sign in to the KUMA console.

   You can use one of the following methods:

   • In the main menu of OSMP Console, go to Settings → KUMA.
   • In your browser, go to https://kuma.<smp_domain>:7220.
2. In the KUMA console, create a resource set for each KUMA service (storages, collectors, and correlators) that you want to install on the prepared hosts in the network infrastructure.
3. Create services for storages, collectors, and correlators in KUMA Console.
4. Obtain the service identifiers to bind the created resource sets and the KUMA services:
   1. In the KUMA Console main menu, go to Resources → Active services.
   2. Select the required KUMA service, and then click the Copy ID button.
5. On the prepared hosts in the network infrastructure, run the corresponding commands to install the KUMA services. Use the service identifiers that were obtained earlier:
   • Installation command for the storage:

     sudo /opt/kaspersky/kuma/kuma storage --core https://<KUMA Core server FQDN>:7210 --id <service ID copied from the KUMA Console> --install

   • Installation command for the collector:

     sudo /opt/kaspersky/kuma/kuma collector --core https://<KUMA Core server FQDN>:7210 --id <service ID copied from the KUMA Console> --api.port <port used for communication with the collector>

   • Installation command for the correlator:

     sudo /opt/kaspersky/kuma/kuma correlator --core https://<KUMA Core server FQDN>:7210 --id <service ID copied from the KUMA Console> --api.port <port used for communication with the correlator> --install

   By default, the FQDN of the KUMA Core is kuma.<smp_domain>.

   The port that is used for connection to KUMA Core cannot be changed. By default, port 7210 is used.

   Open ports that correspond to the installed collector and correlator on the server (TCP 7221 and other ports used for service installation as the --api.port <port> parameter values).

6. During the installation of the KUMA services, read the End User License Agreement (EULA) of KUMA. The text is displayed in the command line window. Press the space bar to view the next text segment. Then, when prompted, enter the following values:
   • Enter y if you understand and accept the terms of the EULA.
   • Enter n if you do not accept the terms of the EULA. To use the KUMA services, you must accept the terms of the EULA.

   You can read the EULA of KUMA after the installation of the KUMA services in one of the following ways:

   • On hosts, it is included in the kuma_utils group in the KUMA inventory file: open the LICENSE file located in the /opt/kaspersky/kuma/utils directory.
   • On hosts, it is included in other groups (kuma_storage, kuma_collector, or kuma_correlator) in the KUMA inventory file: open the LICENSE file located in the /opt/kaspersky/kuma directory.
   • Run the following command:

     /opt/kaspersky/kuma/kuma license --show

   After you accept the EULA, the KUMA services are installed on the prepared machines in the network infrastructure.

7. If necessary, verify that the collector and correlator are ready to receive events.
8. If necessary, install agents in the KUMA network infrastructure.

   The files required for the agent installation are located in the /opt/kaspersky/kuma/utils directory.

The KUMA services required for the function of Kaspersky Next XDR Expert are installed.

Deployment of multiple Kubernetes clusters and Kaspersky Next XDR Expert instances

KDT allows you to deploy multiple Kubernetes clusters with Kaspersky Next XDR Expert instances and switch between them by using contexts. Context is a set of access parameters that define the Kubernetes cluster that the user can select to interact with. The context also includes data for connecting to the cluster by using KDT.

Prerequisites

Before creating contexts and installing Kubernetes clusters with Kaspersky Next XDR Expert instances, you must do the following:

1. Prepare the administrator and target hosts.

   For the installation of multiple clusters and Kaspersky Next XDR Expert instances, you need to prepare one administration host for all clusters and separate sets of target hosts for each of the clusters. Kubernetes components should not be installed on the target hosts.

2. Prepare the hosts for installation of the KUMA services.

   For installation of the KUMA services, you need to prepare separate sets of hosts for each Kaspersky Next XDR Expert instance.

3. Prepare the KUMA inventory file.

   For installation of the KUMA services, you need to prepare separate inventory files for each Kaspersky Next XDR Expert instance.

4. Prepare the configuration file.

   For installation of multiple clusters and Kaspersky Next XDR Expert instances, you need to prepare configuration files for each Kaspersky Next XDR Expert instance. In these configuration files, specify the corresponding administration and target hosts, and other parameters specific to a particular cluster and Kaspersky Next XDR Expert instance.

Process

To create a context with the Kubernetes cluster and Kaspersky Next XDR Expert instance:

1. On the administrator host where the KDT utility is located, run the following command and specify the context name:

   ./kdt ctx <context_name> --create

   The context with the specified name is created.

2. Install the Kubernetes cluster and Kaspersky Next XDR Expert.

The cluster with the Kaspersky Next XDR Expert instance is deployed in the context. The creation of the context is finished.

You can repeat this procedure to create the required number of contexts with installed clusters and Kaspersky Next XDR Expert instances.

You must deploy the Kubernetes cluster and the Kaspersky Next XDR Expert instance after you create the context to finish the context creation. If you do not perform the deployment in the context, and then create another context, the first context will be removed.

You can view the list of created contexts by using the following command:

./kdt ctx

If you want to switch to the required context, run the following command and specify the context name:

./kdt ctx <context_name>

After you select the context, KDT connects to the corresponding Kubernetes cluster. Now, you can work with this cluster and the Kaspersky Next XDR Expert instance. KDT commands are applied to the selected cluster.

When you remove the Kaspersky Next XDR Expert components installed in the Kubernetes cluster and the cluster itself by using KDT, the corresponding contexts are also removed. Other contexts and their clusters with Kaspersky Next XDR Expert instances are not removed.

Signing in to Kaspersky Next XDR Expert

To sign in to Kaspersky Next XDR Expert, you must know the web address of Open Single Management Platform Console. In your browser, JavaScript must be enabled.

To sign in to Open Single Management Platform Console:

1. In your browser, go to <Open Single Management Platform Console web address>.

   The sign-in page is displayed.

2. Do one of the following:
   • To sign in to Open Single Management Platform Console with a domain user account, enter the user name and password of the domain user.

     You can enter the user name of the domain user in one of the following formats:

     • Username@dns.domain
     • NTDOMAIN\Username

     Before you sign in with a domain user account, poll the domain controller to obtain the list of domain users.

   • Enter the user name and password of the internal user.
   • If one or more virtual Servers are created on the Server and you want to sign in to a virtual Server:
     1. Click Show virtual Server options.
     2. Type the virtual Server name that you specified while creating the virtual Server.
     3. Enter the user name and password of the internal or domain user who has rights on the virtual Server.
3. Click the Sign in button.

After sign-in, the dashboard is displayed, and it contains the language and theme that you used the last time you signed in.

Kaspersky Next XDR Expert allows you to work with Open Single Management Platform Console and KUMA Console interfaces.

If you sign in to one of the consoles, and then open the other console on a different tab of the same browser window, you are signed in to the other console without having to re-enter the credentials. In this case, when you sign out of one console, the session also ends for the other console.

If you use different browser windows or different devices to sign in to Open Single Management Platform Console and KUMA Console, you have to re-enter the credentials. In this case, when you sign out of one console on the browser window or device where it is open, the session continues on the window or device where the other console is open.

To sign out of Open Single Management Platform Console,

In the main menu, go to your account settings, and then select Sign out.

Open Single Management Platform Console is closed and the sign-in page is displayed.