Network Environment Configuration
A HyperSec HyperCollector is both an event destination for organisational cyber data as well as (optionally) a source for network discovery.
Route Requirements
Routing to all sources of event data.
If Network Discovery is used then routing to all networks where discovery scans are required.
Port Filtering
The HyperCollector has dynamically configurable ports for all services, however this guide assumes the default ports will be used for common and 80/20 sources.
Recommended Configuration - Inbound
| Type | Protocol | Port |
|---|---|---|
| Syslog UDP (general) | UDP | 514 |
| Syslog TCP (general) | TCP | 601 |
| Linux Syslog auto-deploy | TCP | 12205 |
| Linux Auditd auto-deploy | TCP | 12201 |
| NXLog | TCP | 1514 |
| Beats (lumberjack) | TCP | 5044 |
| HyperSec Agent | TCP | 8084 |
| Netflow | UDP/TCP | 2055 |
| WEF | TCP | 5985, 5986 |
| Agreed pre-reserved range for additional custom sources | TCP/UDP | 20000- 21000 |
The agreed pre-reserved range can be any agreed port range. The outcome is a pre-reserved range of ports that can be used without requiring network change control.
The Minimum configuration is the same as the Recommended configuration without the pre-reserved port range.
WEF
If a Windows Event Forwarding model is applied ensure communications connectivity is available within your organisation’s communications infrastructure and TCP ports 5985 and 5986 are not filtered.
Ensure there is at a minimum:
- TCP/5985 and TCP/5986 connectivity from the Windows endpoint systems to both:
- The WEC Servers
- The HyperCollectors
For full options, also permit:
- TCP/5985 and TCP/5986 connectivity from the WEC servers to the Windows endpoint systems.
Recommended Configuration - Outbound
If discovery is being used it is recommended there be no port restrictions for outbound traffic.
Management Ports
Management ports, access to manage the HyperCollector itself, should permit the following:
- TCP/22
- TCP/443