> ## Documentation Index
> Fetch the complete documentation index at: https://kvm.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# AIO & Sensor KVM Installer User Guide

> Install, deploy, validate, and maintain Stellar Cyber OpenXDR AIO and Sensor VMs on an Ubuntu Server 24.04 LTS KVM host.

# AIO & Sensor KVM Installer User Guide

![AIO & Sensor KVM Installer complete installation flow](https://mintcdn.com/kvm-installer/eizaosBNdBuJxqYR/images/AIO-Sensor/1.png?fit=max\&auto=format\&n=eizaosBNdBuJxqYR\&q=85\&s=a597c69b7ed24cd6ca10d0cc58f75659)

## Overview

Use this page as the **complete AIO + Sensor deployment runbook**. It includes product-specific hardware guidance, KVM deployment, AIO initialization, Data Lake storage, Sensor registration, authorization, and Receiver validation.

The documented baseline is Ubuntu Server 24.04 LTS. For a compact post-deployment-only view, see **[AIO & Sensor Initial Configuration](https://kvm.xdr.ooo/installers/aio-sensor-initial-configuration.md)**.

## 1. System Architecture

### Validated Dell PowerEdge R650 / R660 / R670 Configuration

![Validated Dell PowerEdge R650, R660, and R670 AIO and Sensor KVM architecture](https://mintcdn.com/kvm-installer/eizaosBNdBuJxqYR/images/AIO-Sensor/2.png?fit=max\&auto=format\&n=eizaosBNdBuJxqYR\&q=85\&s=145aa939698cdb54fbdb8e50ca7dfb11)

| Component | Example value |
| - | - |
| Validated KVM Hosts | Dell PowerEdge R650 / R660 / R670 — Ubuntu 24.04 |
| AIO VM | 48 vCPU, 136 GB RAM |
| MDS VM | 44 vCPU, 80 GB RAM |
| Host Access | 1 GbE UTP, local-only `192.168.0.100` |
| Management & Data Link | 1 GbE or 10 GbE |
| Sensor SPAN | PCI Passthrough |
| OS / VM Disk | 1 × 1.92 TB — Ubuntu 24.04, AIO VM, MDS VM |
| Data Lake | 6 × 3.84 TB — for DLm and AIO |

### Hardware at a Glance

The `AIO-Sensor-Installer.sh` workflow has been validated on Dell PowerEdge R650, R660, and R670 servers. The repository also documents a generic installer starting baseline of **12 vCPU, 16 GB memory, and 100 GB free storage**, but that is **not a production AIO + Sensor sizing recommendation**. The sizing example below uses:

| Item | Validated example / requirement |
| - | - |
| AIO VM | 48 vCPU, 136 GB RAM |
| Sensor VM | 44 vCPU, 80 GB RAM |
| OS / VM disk | 1 × 1.92 TB |
| Data Lake | 6 × 3.84 TB |
| Management | NAT mode |
| Sensor SPAN | PCI Passthrough |
| BIOS | CPU virtualization and VT-d/IOMMU enabled |
| OS | Ubuntu Server 24.04 LTS |

> [!WARNING]
>
> Do not interpret the generic 12 vCPU / 16 GB / 100 GB repository baseline as production sizing for an integrated AIO + Sensor deployment.

### Architecture Overview

Stellar Cyber OpenXDR Platform is deployed on one physical server using KVM virtualization.

The installer automatically creates and configures:

* Ubuntu 24.04 KVM host
* libvirt / qemu-kvm virtualization layer
* AIO virtual machine (integrated Data Platform + Analyzer)
* Sensor virtual machine(s)
* NAT-based virtual networking
* PCI Passthrough for SPAN traffic
* LVM-based storage for AIO and Sensor workloads
* CPU affinity and kernel-level performance tuning

The installer automates:

* host OS preparation and tuning
* network configuration and conversion
* storage layout creation
* virtual-machine lifecycle management
* performance-critical configuration such as PCI Passthrough and CPU pinning

## 2. Pre-Installation Preparation

### System Requirements

Before running the installer:

* **root privileges are required**

The installer performs low-level operations including:

* network reconfiguration
* kernel and system tuning
* disk and filesystem configuration
* virtual-machine creation and modification

### Documented Operating System

* This guide is based on **Ubuntu Server 24.04 LTS**.
* For legacy Ubuntu/OpenXDR combinations, verify the current source installer and target-release support scope separately.

## 3. Preparation Steps

1. Switch to a root shell.

```bash theme={null}
sudo -i
```

2. Download the installer into the current directory.

```bash theme={null}
curl -O https://raw.githubusercontent.com/xdr-labs/OpenXDR-KVM-Installer/main/AIO-Sensor-Installer.sh
```

3. Make it executable.

```bash theme={null}
chmod +x AIO-Sensor-Installer.sh
```

4. Run the installer.

```bash theme={null}
./AIO-Sensor-Installer.sh
```

## 4. NIC Preparation and Design Guidance

### Management NIC

The Management NIC is used for:

* remote access to the KVM host
* access to the AIO web interface
* external management traffic

### Sensor Network Mode

* **NAT mode only**
* implemented using the default KVM `virbr0` network
* this design simplifies deployment and reduces operational risk

### SPAN Attachment

* **PCI Passthrough only**
* bridge-based SPAN attachment is not supported
* IOMMU must be enabled in BIOS
* PCI Passthrough provides the highest packet-capture performance for the Sensor workload

### NIC Preparation

Physically connect required NICs before running the installer.

The installer identifies interfaces using **link state**, so connected cables help distinguish NIC roles during selection.

![NAT uplink NIC selection screen](https://mintcdn.com/kvm-installer/eizaosBNdBuJxqYR/images/AIO-Sensor/3.png?fit=max\&auto=format\&n=eizaosBNdBuJxqYR\&q=85\&s=e007e32da4bd559f79c055983d9e56f7)

## 5. Installer Navigation

The installer provides an interactive menu-driven interface implemented with Whiptail.

### Navigation

* **Spacebar or Down Arrow (↓)**: move through menu items
* **Enter**: select
* **q or ESC**: exit a help screen or return to the previous menu

### State-Aware Execution

The installer is **state-aware**.

Installation state is stored under:

```text theme={null}
/root/xdr-installer
```

* completed steps are recorded
* after reboot or interruption, execution resumes from the next incomplete step

To clear all installation state and restart from the beginning:

```bash theme={null}
rm -rf /root/xdr-installer
```

### Mandatory Reboot Steps

The installer automatically reboots after:

* **STEP 03 – network conversion (netplan → ifupdown)**
* **STEP 05 – kernel and system-level tuning**

These reboots are mandatory and must not be skipped.

After reboot:

1. log in again
2. relaunch the installer
3. select Menu 1

The installer resumes automatically.

### Main Menu Overview

#### 1. Auto Execute All Steps

* runs all steps beginning with the next incomplete step
* resumes after reboot from the last completed step
* recommended for:
  * initial installation
  * continuing after reboot

#### 2. Select and Run Specific Step Only

* runs one selected step independently
* recommended for:
  * AIO VM redeployment
  * Sensor VM redeployment
  * network changes
  * image updates
  * SPAN configuration changes

#### 3. Configuration

Configures:

* `DRY_RUN` (default: `1`)
* `AIO_VERSION`
* `SENSOR_VERSION`
* `SENSOR_NET_MODE` (`nat` only)
* `SPAN_ATTACH_MODE` (`pci` only)
* ACPS credentials
  * username
  * password
  * URL

#### 4. Full Configuration Validation

Validates:

* KVM
* AIO VM
* Sensor VM
* networking
* SPAN
* storage

Detailed errors and warnings are displayed.

#### 5. Script Usage Guide

* displays the built-in help guide

#### 6. View Log

* displays the installer log

#### 7. Exit

* exits the installer

## 6. Installation Scenarios

### 6.1 New Installation

This scenario applies immediately after Ubuntu installation.

#### Initial Configuration

From the main menu, select:

```text theme={null}
3) Configuration
```

![AIO & Sensor Installer Configuration screen](https://mintcdn.com/kvm-installer/eizaosBNdBuJxqYR/images/AIO-Sensor/4.png?fit=max\&auto=format\&n=eizaosBNdBuJxqYR\&q=85\&s=21daaea66ee40bcf68912c6607f83e15)

Configure:

* `DRY_RUN` (default: `1`)
  * default: `1` (simulation mode)
  * set to `0` only for real installation
* `AIO_VERSION`
* `SENSOR_VERSION`
* ACPS credentials
  * username
  * password
  * URL
* `AUTO_REBOOT` (default: `1`)
* SPAN mode is fixed to `pci`
* network mode is fixed to NAT

Return to the main menu after configuration.

#### Auto Execute

Select:

```text theme={null}
1) Auto execute all steps
```

![AIO & Sensor Installer Auto Execute All Steps](https://mintcdn.com/kvm-installer/eizaosBNdBuJxqYR/images/AIO-Sensor/5.png?fit=max\&auto=format\&n=eizaosBNdBuJxqYR\&q=85\&s=33422d00aa7ccd717c67f7bf250887ca)

The installer runs:

```text theme={null}
STEP 01 → STEP 02 → STEP 03 → … → STEP 13
```

Execution stops automatically if a reboot is required or an error occurs.

### Mandatory Reboot Behavior

The host is automatically rebooted after:

* **STEP 03 – network configuration changes**
* **STEP 05 – kernel and system tuning**

After reboot:

1. log in again
2. relaunch the installer
3. select Menu 1

The installer resumes from the next incomplete step.

### 6.2 Run a Specific Step

Use this mode to run one installation step without executing the full workflow.

From the main menu, select:

```text theme={null}
2) Select and run specific step only
```

![AIO & Sensor Installer specific-step selection](https://mintcdn.com/kvm-installer/eizaosBNdBuJxqYR/images/AIO-Sensor/6.png?fit=max\&auto=format\&n=eizaosBNdBuJxqYR\&q=85\&s=d160369acf645c646e4005531d73e002)

#### Step List

| Step | Task |
| -: | - |
| 01 | Hardware / NIC / SPAN NIC Selection |
| 02 | HWE Kernel Installation |
| 03 | NIC Name / ifupdown Switch and Network Configuration |
| 04 | KVM / Libvirt Installation and Basic Configuration |
| 05 | Kernel Parameters / KSM / Swap Tuning |
| 06 | libvirt Hooks Installation + NTPsec |
| 07 | LVM Storage Configuration (AIO) |
| 08 | AIO Download |
| 09 | AIO VM Deployment |
| 10 | Sensor LV Creation + Image/Script Download |
| 11 | Sensor VM Deployment |
| 12 | PCI Passthrough / CPU Affinity |
| 13 | Install DP Appliance CLI package |

#### Typical Use Cases

* redeploy the AIO VM
* redeploy the Sensor VM
* reapply PCI Passthrough or CPU affinity
* retry a failed step
* redownload an image or artifact

Only the selected step runs; other completed steps are not changed.

## 7. Post-Installation Validation

After installation, select:

```text theme={null}
4) Full configuration validation
```

![AIO & Sensor Installer Full Configuration Validation results](https://mintcdn.com/kvm-installer/eizaosBNdBuJxqYR/images/AIO-Sensor/7.png?fit=max\&auto=format\&n=eizaosBNdBuJxqYR\&q=85\&s=3d2a66dd1cc802967238db53cfead49c)

Validation includes:

* KVM and libvirt service status
* AIO and Sensor VM status and autostart
* network configuration
* storage availability and mount points

If warnings appear, use Menu 2 to rerun the relevant step.

## 8. Common Post-Installation Changes

### Automatic Reboot Notice

* **STEP 03 always triggers a reboot.**

### Change Scenarios

#### Change Management NIC or IP

```text theme={null}
STEP 01 → STEP 03
```

#### Reconfigure SPAN NICs (PCI only)

```text theme={null}
STEP 01 → STEP 03 → STEP 12
```

#### Redeploy the AIO VM

```text theme={null}
STEP 07 → STEP 09 → STEP 12
```

> [!WARNING]
>
> The existing VM is deleted and the ES data store cannot be reused.

#### Redeploy the Sensor VM

```text theme={null}
STEP 11 → STEP 12
```

> [!WARNING]
>
> The existing Sensor VM is deleted.

## 9. Required AIO & Sensor Initial Configuration

After Full Configuration Validation confirms VM deployment, complete the following appliance configuration.

### 9.1 Fixed KVM Network

* AIO: `192.168.122.2/24`
* Sensor/MDS: `192.168.122.3/24`
* Gateway: `192.168.122.1`
* DNS: `8.8.8.8`

### 9.2 Configure the AIO

Log in with `aella / changeme`, change the password when prompted, then configure:

```text theme={null}
set interface management ip 192.168.122.2/24
set interface management gateway 192.168.122.1
set interface management dns 8.8.8.8
set role AIO
set cluster_name AIO
set cluster_size 1
set cm 192.168.122.2
set otp <YOUR-OTP>
reset
```

After initialization:

```text theme={null}
show status
```

Verify the platform reaches a ready/healthy state.

### 9.3 Add AIO Data Storage

```text theme={null}
show storage
add storage blk vdb
show storage
```

> [!WARNING]
>
> `add storage blk` formats the selected device. Confirm `vdb` and its expected capacity before approving.

In the GUI, go to **System → DATA MANAGEMENT → Data Management → Advanced**, migrate to `/es-data-lvm`, then verify **Data Storage Space** under **System → DATA MANAGEMENT → Data Lake**.

### 9.4 Connect the Sensor

Log in to the Sensor with `aella / changeme`, change the password, reconnect, then configure:

```text theme={null}
set interface management ip 192.168.122.3/24
set interface management gateway 192.168.122.1
set interface management dns 8.8.8.8
show interfaces
set hostname <UNIQUE-SENSOR-HOSTNAME>
set cm 192.168.122.2
show cm
```

Optional:

```text theme={null}
set proxy http://<PROXY-IP>:<PORT>
set tenant_id <TENANT-ID>
```

Confirm **CM Controller = 192.168.122.2** and **Status = Established**, then `quit`.

### 9.5 NTP, Authorization, Receiver

* Configure NTP and timezone.
* Authorize the registered Sensor in Stellar Cyber.
* Receiver must point to **AIO/DP**, not DA-Master.
* Verify the intended Sensor Profile uses that Receiver.
* If `show logforwarder` has no output, check Receiver configuration first.

### 9.6 Access

```text theme={null}
console aio
console mds
```

* AIO SSH: **2222**
* MDS SSH: **2223**

### 9.7 Final Checklist

* Full Configuration Validation has no unresolved FAIL.
* AIO = `192.168.122.2/24`; Sensor = `192.168.122.3/24`.
* AIO `show status` is ready/healthy.
* `vdb` is added and Data Lake migration to `/es-data-lvm` is complete.
* Sensor hostname is unique.
* Sensor `show cm` is **Established** to `192.168.122.2`.
* NTP/timezone and Sensor authorization are complete.
* Receiver and Sensor Profile are correct.
* Default passwords have been changed.

For a post-deployment-only view, use **[AIO & Sensor Initial Configuration](https://kvm.xdr.ooo/installers/aio-sensor-initial-configuration.md)**.

## 10. Hardware and Software Requirements

Before real execution, confirm:

* Ubuntu Server 24.04 LTS
* root access
* CPU hardware virtualization enabled
* VT-d/IOMMU enabled for Sensor PCI Passthrough
* sufficient CPU/memory for intended AIO and Sensor sizing
* sufficient OS/VM storage and dedicated Data Lake disks
* management connectivity and required Sensor SPAN NICs
* network access for package and image downloads
* console or out-of-band access before network conversion

The **[Ubuntu 24.04 Installation Guide](https://kvm.xdr.ooo/getting-started/installing-ubuntu-24-04.md)** is optional background; product-specific guidance is summarized here.

## 11. BIOS and Platform Settings

Verify Intel VT-x / AMD-V and Intel VT-d / AMD-Vi (IOMMU). These are required for the documented Sensor PCI Passthrough design.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.