Skip to main content
Versa Networks

Configure VMS to Integrate EDR Platforms

  1. Last updated
  2. Save as PDF

Versa-logo-release-icon.pngFor supported software information, click here.

Endpoint detection and response (EDR) is a cybersecurity technology that monitors and responds to threats coming from endpoint devices such as laptops, mobile phones, and internet-of-things (IoT) devices. You integrate EDR platforms with Versa Unified Endpoint risk-scoring microservices in Versa Advanced Security Cloud (ASC). These microservices generate risk scores that Versa Concerto uses across multiple security policies to enforce dynamic, risk-based access and protection controls.

Before you integrate EDR platforms such as CrowdStrike, Microsoft Defender, and SentinelOne with Concerto, you complete the following tasks from Versa Director for Versa Messaging Service (VMS): 

  1. Configure a Kafka cluster—Enable and configure a Kafka cluster for the VMS connector by enabling the Kafka service.
  2. Enable and Configure the ASC Service in VMS—Enable and configure the ASC service for the provider tenant in the VMS connector.
  3. Configure an advanced VMS connector—Send device risk score (DRS) information included in the unified entity risk profiles of the Network Management System (NMS) to the advanced VMS connector rather than the configuration server connector.

After you perform these tasks, do the following (these are not covered in this article): 

  1. Create unified entity risk profiles in Concerto to assign weight values to different sources when calculating an endpoint's risk score. For more information, see Configure Endpoint Information Profiles. 
  2. Integrate Versa Unified Endpoint risk scoring with CrowdStrike, Microsoft Defender, or SentinelOne from Concerto to collect and aggregate data from endpoints. For more information, see Configure Endpoint Detection and Response.  
  3. Use risk scores or bands as an input for Versa unified endpoint risk profiles to enforce network policy rules in Concerto. You can use this risk score while creating security policies and rules for internet applications, secure access policies, and private applications. For more information, see Configure Unified Entity Risk Profiles in Concerto and Configure Entity Risk Bands for Security Policies and Rules.

Configure a Kafka Cluster

To configure a Kafka cluster, you configure a VMS cluster consisting of two VMS nodes, and then enable Kafka MirrorMaker on both VMS nodes. The VMS nodes provide redundancy and fault tolerance, which ensures high availability for VMS. Also, configuring Kafka MirrorMaker on both VMS nodes ensures continuous data replication and seamless failover in case of a node failure.

Requirements

Before you begin, ensure that your system meets the following requirements:

  • VMS nodes must run Release 5.3.1 or later.
  • At least two VMS nodes must be up and running. 
  • The elastic FQDN or IP addresses of both VMS nodes must be able to ping each other.

Enable and Configure Kafka MirrorMaker

Kafka MirrorMaker replicates data between Kafka clusters by consuming messages from a source cluster and producing them to a target cluster. This is useful for disaster recovery, geo-replication, data migration, and multi-datacenter deployments.

To configure Kafka MirrorMaker for a VMS cluster:

  1. In Director view, select the Administration tab in the top menu bar.
  2. Select Connectors > VMS in the left menu bar.

    vms-menu-1.png
  3. Click + Add. The Configure VMS Connection configuration wizard displays. 
  4. Enter the required information in workflow step 1, VMS Connection. For more information, see Configure a VMS Connector.
  5. Select workflow step 2, VMS Cluster, and then enter information for the following fields.

    vms-cluster-tab-kafka-mirror-maker.png
    1. In the Kafka Cluster Name field, enter the unique cluster name in this format: vms-cluster-<cluster-name>.
    2. In the Retention Hours field, enter how long messages are retained in the Kafka topics before deletion, in hours. The default value is 168 hours (7 days). Note that the value must be greater than 0 (zero).
    3. In the Retention Bytes field, enter the maximum size of data retained per partition before older messages are cleared, in bytes. The default value is 536,870,912 bytes (512 MB). Note that the value must be greater than 0 (zero).
    4. For information about configuring other fields, see Configure a VMS Connector.
  6. Click the Kafka MirrorMaker toggle to enable the feature. The following section displays. 

    add-cluster-pair-button.png
  7.  Click + Add Cluster Pair to configure a Kafka MirrorMaker cluster pair between the VMS instances. 
  8. Enter information for the following fields.

    kafka-mirrormaker-cluster-pair-fields.png
     
    Field Description
    From Cluster (Group of Fields) Enter the following information for the source cluster.
    • Alias

    Enter a name to identify the source Kafka cluster for display and reference purposes, for example, vms-cluster-two. Configure this based on the destination cluster (To Cluster).
    • Bootstrap Servers

    Enter the hostname and port of the destination Kafka broker where mirrored data is produced. Configure this based on the destination cluster (To Cluster).
    • Username
    		 Enter the authentication username for connecting to the source cluster. This validates and authenticates the Kafka MirrorMaker service for secure communication between VMS instances. 
    • Password
    		 Enter the authentication password for the source cluster. The password must be between 32 and 45 characters. This validates and authenticates the Kafka MirrorMaker service for secure communication between VMS instances.
    To Cluster (Group of Fields) Enter the following information for the destination cluster. 
    • Alias

    (Read-only.) Displays the name you enter in the Kafka Cluster Name field.  
    • Bootstrap Servers

    (Read-only.) Displays the hostname and port you enter in the VMS Elastic Hostname/FQDN for Agents field. 
    • Username
    		 Enter the authentication username for connecting to the destination cluster. This validates and authenticates the Kafka MirrorMaker service for secure communication between VMS instances.
    • Password
    		 Enter the authentication password for the destination cluster. The password must be between 32 and 45 characters. This validates and authenticates the Kafka MirrorMaker service for secure communication between VMS instances.
  9. Click Next to go to workflow step 3, Tenants and Services. In this screen, you enable the Kafka MirrorMaker service for specific tenants. 

    vms-connector-tenants-services.png
  10. Select the tenants for which you want to enable the Kafka MirrorMaker service. You can select multiple tenants and enable the service for each of them.
  11. To enable the Kafka MirrorMaker service for a tenant, click the down arrow for a tenant in the Tenant Selected section to display the available service options. The Services section displays.

    vms-services-vos-services-aggregator.png
  12. Click the VOS-Services Aggregator toggle. Note that Kafka MirrorMaker is currently supported only for VOS-Services Aggregator. The fields associated with the VOS Services Aggregator display:

    vos-services-aggregator-fields.png
  13. Click the MirrorMaker checkbox to enable the Kafka MirrorMaker service for the selected tenant.
  14. Enter a name in the Group Name field to identify the group. Group Name acts as a consumer group identifier in Kafka. The remaining fields are automatically filled.
  15. For information about configuring other fields, see Configure a VMS Connector.
  16. Click Next or select workflow step 4, Review, to review and submit the updates.

Enable and Configure the ASC Service in VMS

Versa ASC receives unified entity risk profile configurations from Concerto and assigns weights to scores from various sources such as EDRs, vulnerability and threat management systems, and Unified Endpoint Management (UEM), formerly known as the SASE Mobile Device Manager (MDM). It then calculates a unified entity risk score and distributes it to SASE gateways through VMS. Note that you must enable the ASC service in the provider tenant. 

To enable and configure the ASC service from VMS:

  1. In Director view, select the Administration tab in the top menu bar.
  2. Select Connectors > VMS in the left menu bar.
  3. Click + Add or select an existing VMS connector. The Configure VMS Connection configuration wizard displays. 
  4. Select workflow step 3, Tenants and Services. 

    vms-connector-asc-service-enable.png
  5. Select the provider tenant and click the down arrow in the Tenant Selected section to display the Services section. 
  6. Click the ASC toggle in the Services section to enable the ASC service. This activates the ASC fields.

    asc-service-fields.png
  7.  Enter information for the following fields.
     
    Field Description
    ASC Services FQDN Enter the FQDN of the ASC service endpoint. This is the hostname that VMS uses to communicate with the ASC cloud service.
    ASC Services Port

    Enter the network port number to connect to the ASC service.

    Default: 443
    TLS Enable  Click to enable Transport Layer Security (TLS) for encrypted communication between VMS and the ASC service.
    VMS Server FQDN Enter the FQDN (including the port) of the VMS server that ASC communicates with to receive streaming data.
    CA File Click Browse to upload the Certificate Authority (CA) file to validate the TLS certificate of the ASC server. Note that only .crt files are supported.
    Broker (Group of Fields)

    (Optional) Click + Add Broker and click the down arrow to enter information for the following fields.
    • Topic Name
    		 Enter the Kafka broker topic name that the broker node handles.
    • Group Name
    		 (Optional) Enter a name for the group associated with the broker node. 
    • Address
    		 Enter the IP address or hostname of the broker node that VMS uses to connect to Concerto through the Kafka broker. For example: 10.43.10.198
    • Port
    		 Enter the port number for the broker connection that VMS uses to connect to Concerto through the Kafka broker. For example: 9092
    • SASL Username
    		 Enter the username for Simple Authentication and Security Layer (SASL) authentication with the Kafka broker.
    • SASL Password
    		 Enter the password for SASL authentication. Click Generate Password to auto-generate a secure password.
    • SASL Algorithm
    		 This is automatically filled and displays the SASL authentication algorithm used. The default value is Salted Challenge Response Authentication Mechanism (SCRAM).
    • SASL Mechanism

    This is automatically filled and displays the specific hashing mechanism for SCRAM authentication.

    Default: SHA-512
    • Certificate

    Click the checkbox to use certificates for security. These are the certificates that you generate when you configure the VMS server. For more information, see Configure the Primary VMS Server Using Bash.  Browse to upload the following certificates:

    • CA File—CA file to validate certificates
    • Cert File—Client certificate file
    • Key File—Client private key file
  8. For information about configuring other fields, see Configure a VMS Connector.
  9. Click Next or select workflow step 4, Review, to review and submit the updates.

Configure an Advanced VMS Connector

You configure an advanced VMS connector if you have configured the ASC service as described in Enable and Configure the ASC Service in VMS, above. When you configure an advanced VMS connector, device risk score (DRS) information included in the unified entity risk profiles (nms/org/unified-entity-risk-profiles) of the Network Management System (NMS) is sent to the advanced VMS connector rather than the configuration server connector.

  1. In Director view, select the Administration tab in the top menu bar.
  2. Select Connectors > Advance Security Cloud > Advanced VMS in the left menu bar. Note that you can configure only one advanced VMS connector and the following screenshot displays an existing connector.

    advanced-vms-connector-menu.png
  3. Click + Add to create a new advanced VMS connector, or click the Edit icon under Actions to edit an existing connector (as shown above). 
  4. In the Add or Edit Advanced VMS Connector window, enter information for the following fields.

    edit-advanced-vms-connector.png
     
    Field Description
    Cluster Name Enter a unique name for the VMS cluster to distinguish the connector configuration within the system. 
    Description (Optional) Enter a description for the connector.
    FQDN Enter the fully qualified domain name (FQDN) of the VMS cluster endpoint to establish communication with the target system.
    Server CA Certificate Click Browse to upload the root or intermediate CA certificate to validate the identity of the VMS server during TLS authentication. 
    Client Certificate Click Browse to upload the client-side certificate for mutual TLS (mTLS) authentication when connecting to the VMS cluster. 
    Client Private Key Click Browse to upload the private key corresponding to the uploaded client certificate. This is required to complete secure client authentication. 
  5. Click OK.

Supported Software Information  

VMS Releases 5.3.1 and later support all content described in this article.

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Page type
    Topic
  2. Tags
    This page has no tags.