Preflight Checklist

When deploying HyperCollectors into your organisation a short number of questions need to be answered

1. Which sources do you wish to integrate?
2. To which level of cyber quality and fidelity do you wish to obtain these sources?
3. What are the deployment, maintenance and governance mechanisms that need to be engaged to perform this integration?

Sources

The HyperCollector supports a wide variety if multi-vendor sources, natively out of the box. In addition, automated and SOP supported integration tools are provided for the most commonly high value sources an organisation may have, Such as Windows and Linux.

Standard HyperCollector sources are grouped as follows:

• Windows, supported by Windows Event Forwarding or a local agent.
• Linux, supported by rsyslog.
• Elastic Beats sources.
• Netflow
• NXLog
• Broader syslog

Each of these sources has end-to-end integrated source-through-to-store and analysis technology and automation to support them. This guide will focus on the organsational integration of a HyperCollector to:

• Obtain the highest quality and value cyber data for detection, prevention and analysis;
• and Minimise the impact on business IT infrastructure for:
• Deployment
• Maintenance
• Component integration risk

A HyperSec HyperCollector deployment heavily emphasises these last two goals. For example, agent is deployed on an endpoint as the last option, not the first, and native systems (e.g. Microsoft, Linux) are used or leveraged wherever present.

Discovery

The HyperSec HyperCollector also provides an optional Network Discovery function. The HyperCollector can periodically scan the local IT environment, mapping out its network topology and fingerprinting devices found.

The primary benefits of this capability are:

• Find the unknown, un-logged or unaudited devices, which are often a major source of cyber risk.
• Provide greater context to log data, significantly increasing the effectiveness of event data for both alerting and cyber analyst triage.
• A reliable, updated "what is actually on my network" database of systems and status for cyber and IT operations managers, instead of CMDB reliance.
• Agentless, passive scanning.

VPN

If connecting to an HyperSec XDR - enabled SOC or HyperSec Cloud, connectivity back to Receivers for ingestion is required. This is performed by two VPN approaches:

• HyperCollector initiated
• Site to Site VPN

Direct organisational network connectivity is also an option but is relatively simple and not covered in this guide.