Skip to main content

AIO & Sensor KVM Installer User Guide

AIO & Sensor KVM Installer complete installation flow

Overview

Use this page as the complete AIO + Sensor deployment runbook. It includes product-specific hardware guidance, KVM deployment, AIO initialization, Data Lake storage, Sensor registration, authorization, and Receiver validation. The documented baseline is Ubuntu Server 24.04 LTS. For a compact post-deployment-only view, see AIO & Sensor Initial Configuration.

1. System Architecture

Validated Dell PowerEdge R650 / R660 / R670 Configuration

Validated Dell PowerEdge R650, R660, and R670 AIO and Sensor KVM architecture

Hardware at a Glance

The AIO-Sensor-Installer.sh workflow has been validated on Dell PowerEdge R650, R660, and R670 servers. The repository also documents a generic installer starting baseline of 12 vCPU, 16 GB memory, and 100 GB free storage, but that is not a production AIO + Sensor sizing recommendation. The sizing example below uses:
Do not interpret the generic 12 vCPU / 16 GB / 100 GB repository baseline as production sizing for an integrated AIO + Sensor deployment.

Architecture Overview

Stellar Cyber OpenXDR Platform is deployed on one physical server using KVM virtualization. The installer automatically creates and configures:
  • Ubuntu 24.04 KVM host
  • libvirt / qemu-kvm virtualization layer
  • AIO virtual machine (integrated Data Platform + Analyzer)
  • Sensor virtual machine(s)
  • NAT-based virtual networking
  • PCI Passthrough for SPAN traffic
  • LVM-based storage for AIO and Sensor workloads
  • CPU affinity and kernel-level performance tuning
The installer automates:
  • host OS preparation and tuning
  • network configuration and conversion
  • storage layout creation
  • virtual-machine lifecycle management
  • performance-critical configuration such as PCI Passthrough and CPU pinning

2. Pre-Installation Preparation

System Requirements

Before running the installer:
  • root privileges are required
The installer performs low-level operations including:
  • network reconfiguration
  • kernel and system tuning
  • disk and filesystem configuration
  • virtual-machine creation and modification

Documented Operating System

  • This guide is based on Ubuntu Server 24.04 LTS.
  • For legacy Ubuntu/OpenXDR combinations, verify the current source installer and target-release support scope separately.

3. Preparation Steps

  1. Switch to a root shell.
  1. Download the installer into the current directory.
  1. Make it executable.
  1. Run the installer.

4. NIC Preparation and Design Guidance

Management NIC

The Management NIC is used for:
  • remote access to the KVM host
  • access to the AIO web interface
  • external management traffic

Sensor Network Mode

  • NAT mode only
  • implemented using the default KVM virbr0 network
  • this design simplifies deployment and reduces operational risk

SPAN Attachment

  • PCI Passthrough only
  • bridge-based SPAN attachment is not supported
  • IOMMU must be enabled in BIOS
  • PCI Passthrough provides the highest packet-capture performance for the Sensor workload

NIC Preparation

Physically connect required NICs before running the installer. The installer identifies interfaces using link state, so connected cables help distinguish NIC roles during selection. NAT uplink NIC selection screen

5. Installer Navigation

The installer provides an interactive menu-driven interface implemented with Whiptail.
  • Spacebar or Down Arrow (↓): move through menu items
  • Enter: select
  • q or ESC: exit a help screen or return to the previous menu

State-Aware Execution

The installer is state-aware. Installation state is stored under:
  • completed steps are recorded
  • after reboot or interruption, execution resumes from the next incomplete step
To clear all installation state and restart from the beginning:

Mandatory Reboot Steps

The installer automatically reboots after:
  • STEP 03 – network conversion (netplan → ifupdown)
  • STEP 05 – kernel and system-level tuning
These reboots are mandatory and must not be skipped. After reboot:
  1. log in again
  2. relaunch the installer
  3. select Menu 1
The installer resumes automatically.

1. Auto Execute All Steps

  • runs all steps beginning with the next incomplete step
  • resumes after reboot from the last completed step
  • recommended for:
    • initial installation
    • continuing after reboot

2. Select and Run Specific Step Only

  • runs one selected step independently
  • recommended for:
    • AIO VM redeployment
    • Sensor VM redeployment
    • network changes
    • image updates
    • SPAN configuration changes

3. Configuration

Configures:
  • DRY_RUN (default: 1)
  • AIO_VERSION
  • SENSOR_VERSION
  • SENSOR_NET_MODE (nat only)
  • SPAN_ATTACH_MODE (pci only)
  • ACPS credentials
    • username
    • password
    • URL

4. Full Configuration Validation

Validates:
  • KVM
  • AIO VM
  • Sensor VM
  • networking
  • SPAN
  • storage
Detailed errors and warnings are displayed.

5. Script Usage Guide

  • displays the built-in help guide

6. View Log

  • displays the installer log

7. Exit

  • exits the installer

6. Installation Scenarios

6.1 New Installation

This scenario applies immediately after Ubuntu installation.

Initial Configuration

From the main menu, select:
AIO & Sensor Installer Configuration screen Configure:
  • DRY_RUN (default: 1)
    • default: 1 (simulation mode)
    • set to 0 only for real installation
  • AIO_VERSION
  • SENSOR_VERSION
  • ACPS credentials
    • username
    • password
    • URL
  • AUTO_REBOOT (default: 1)
  • SPAN mode is fixed to pci
  • network mode is fixed to NAT
Return to the main menu after configuration.

Auto Execute

Select:
AIO & Sensor Installer Auto Execute All Steps The installer runs:
Execution stops automatically if a reboot is required or an error occurs.

Mandatory Reboot Behavior

The host is automatically rebooted after:
  • STEP 03 – network configuration changes
  • STEP 05 – kernel and system tuning
After reboot:
  1. log in again
  2. relaunch the installer
  3. select Menu 1
The installer resumes from the next incomplete step.

6.2 Run a Specific Step

Use this mode to run one installation step without executing the full workflow. From the main menu, select:
AIO & Sensor Installer specific-step selection

Step List

Typical Use Cases

  • redeploy the AIO VM
  • redeploy the Sensor VM
  • reapply PCI Passthrough or CPU affinity
  • retry a failed step
  • redownload an image or artifact
Only the selected step runs; other completed steps are not changed.

7. Post-Installation Validation

After installation, select:
AIO & Sensor Installer Full Configuration Validation results Validation includes:
  • KVM and libvirt service status
  • AIO and Sensor VM status and autostart
  • network configuration
  • storage availability and mount points
If warnings appear, use Menu 2 to rerun the relevant step.

8. Common Post-Installation Changes

Automatic Reboot Notice

  • STEP 03 always triggers a reboot.

Change Scenarios

Change Management NIC or IP

Reconfigure SPAN NICs (PCI only)

Redeploy the AIO VM

The existing VM is deleted and the ES data store cannot be reused.

Redeploy the Sensor VM

The existing Sensor VM is deleted.

9. Required AIO & Sensor Initial Configuration

After Full Configuration Validation confirms VM deployment, complete the following appliance configuration.

9.1 Fixed KVM Network

  • AIO: 192.168.122.2/24
  • Sensor/MDS: 192.168.122.3/24
  • Gateway: 192.168.122.1
  • DNS: 8.8.8.8

9.2 Configure the AIO

Log in with aella / changeme, change the password when prompted, then configure:
After initialization:
Verify the platform reaches a ready/healthy state.

9.3 Add AIO Data Storage

add storage blk formats the selected device. Confirm vdb and its expected capacity before approving.
In the GUI, go to System → DATA MANAGEMENT → Data Management → Advanced, migrate to /es-data-lvm, then verify Data Storage Space under System → DATA MANAGEMENT → Data Lake.

9.4 Connect the Sensor

Log in to the Sensor with aella / changeme, change the password, reconnect, then configure:
Optional:
Confirm CM Controller = 192.168.122.2 and Status = Established, then quit.

9.5 NTP, Authorization, Receiver

  • Configure NTP and timezone.
  • Authorize the registered Sensor in Stellar Cyber.
  • Receiver must point to AIO/DP, not DA-Master.
  • Verify the intended Sensor Profile uses that Receiver.
  • If show logforwarder has no output, check Receiver configuration first.

9.6 Access

  • AIO SSH: 2222
  • MDS SSH: 2223

9.7 Final Checklist

  • Full Configuration Validation has no unresolved FAIL.
  • AIO = 192.168.122.2/24; Sensor = 192.168.122.3/24.
  • AIO show status is ready/healthy.
  • vdb is added and Data Lake migration to /es-data-lvm is complete.
  • Sensor hostname is unique.
  • Sensor show cm is Established to 192.168.122.2.
  • NTP/timezone and Sensor authorization are complete.
  • Receiver and Sensor Profile are correct.
  • Default passwords have been changed.
For a post-deployment-only view, use AIO & Sensor Initial Configuration.

10. Hardware and Software Requirements

Before real execution, confirm:
  • Ubuntu Server 24.04 LTS
  • root access
  • CPU hardware virtualization enabled
  • VT-d/IOMMU enabled for Sensor PCI Passthrough
  • sufficient CPU/memory for intended AIO and Sensor sizing
  • sufficient OS/VM storage and dedicated Data Lake disks
  • management connectivity and required Sensor SPAN NICs
  • network access for package and image downloads
  • console or out-of-band access before network conversion
The Ubuntu 24.04 Installation Guide is optional background; product-specific guidance is summarized here.

11. BIOS and Platform Settings

Verify Intel VT-x / AMD-V and Intel VT-d / AMD-Vi (IOMMU). These are required for the documented Sensor PCI Passthrough design.
Last modified on September 24, 2026