Add Insights Nodes

Use Security Director Insights to automate security operations and take effective actions on security events logged by Juniper Networks Security products. It connects disparate security tools for seamless security operations and incident response. It ingests logs from SRX Series devices and other security vendors to correlate and provide automated enrichment to identify the threats.

Security Director Insights is a single virtual appliance (Service VM) that runs on the VMware vSphere infrastructure. You must configure Security Director Insights as nodes for Security Director to discover the Security Director Insights virtual machine (VM).

You can deploy Security Director Insights as a single node or two nodes (primary and secondary) with high availability (HA).

To configure a standalone or primary (active) node:

Select Security Director > Administration >Insights Management > Insights Nodes.
The Insights Nodes page appears.
Complete the configuration according to the guidelines provided in Table 1.
Click Save.
If the details provided are valid, the Security Director Insights node is added successfully. Click Reset to remove the node.

Table 1: Add Insights Nodes
Setting	Guidelines
IP Address	Enter the IP address of the Security Director Insights VM. (This is the IP address you configured during the Security Director Insights VM installation).
Username	The username to access the VM is always admin. You cannot modify this field.
Password	Enter the password to access the Security Director Insights VM. (This is the same password you use to log in to the VM CLI with your admin credentials).

To configure the secondary (standby) node details:

Select the Enable HA option.

The HA Setup page appears.
Complete the configuration according to the guidelines provided in Table 2.
Click Save & Enable.

The Insights Nodes page appears. It shows the status of the secondary node activation.
Click Refresh Data to check the status of the secondary node configuration.

After the configuration is successful, you see the respective IP addresses appearing in the Data/Management Virtual IP and Monitoring Virtual IP columns.

Note:
Keep clicking the Refresh Data option until you see that the secondary node is configured successfully and all the other errors disappear, if any.

Table 2: Configure HA Setup
Setting	Guidelines
`Secondary Node Details`
Secondary system IP	Enter the IP address of the secondary (standby) node.
Username	The username to access the virtual machine is always ‘admin’. You cannot modify this field.
Password	Enter your SSH password to access the secondary node. (This is the same password you use to log in to the VM CLI with your admin credentials.)
`HA Settings`
Data Virtual IP/Netmask	Enter the virtual IP address for data traffic between primary (active) and secondary (standby) nodes.
HA monitor Virtual IP/Netmask	Enter the virtual IP address for HA monitoring traffic between active and standby nodes.
Ping IPs	(Optional) Enter a list of IP addresses for ping tests.

Note:

To enable HA, the IP addresses on Security Director Insights must be static.

In the Node Status section, you can see the complete configuration details of the primary (active) and secondary (standby) nodes.

You can take the following actions:

Stop standby—In the Standby section, click Stop to temporarily stop HA service on a standby node to perform maintenance tasks.
Start standby—In the Standby section, click Start to restart the HA service, if it is stopped.
Rebuild standby—To rebuild out-of-sync data on the standby node, click Rebuild.
Failover—To manually shut down the HA service on the active node, so that the standby node becomes the active node, click Failover in the Active section. The virtual IP address will be reassigned to the new active node. You can use the Failover option to perform any maintenance tasks on the active node. You must click Start to restart the HA services.

Table 3 shows more details of each Security Director Insights node in the Insights Node page.

Table 3: Insights Node Details
Field Name	Description
Hostname	Specifies the hostname of the node.
Data Traffic IP	Specifies the data traffic IP address of the node.
HA Monitor IP	Specifies the HA monitoring IP address of the node.
CPU Usage	Specifies the CPU usage of the node.
Memory Usage	Specifies the memory usage of the node.
Online	Specifies whether the node is online or offline.
Role	Specifies whether the node is primary (active) or secondary (standby).
Status	Specifies the health of the node.

Add Insights Nodes

Related Documentation