Cloud ConnectorsSetup

Create a docker config file if one doesn't exist in /etc/docker/daemon.json.

Add an entry to the daemon.json with the subnet for the docker bridge0 to run in, under the "bip" entry. For example:

{ 
    "bip": "192.168.1.5/24"
}

Restart the entire docker service to take effect: sudo systemctl restart docker.

Verify the docker service took effect by running ifconfig docker0 | grep -Po '(?<=inet )[\d.]+' . It should print out the IP address specified in "bip" example of daemon.json full file with only the bip configured in it.

Source: https://docs.docker.com/v17.09/engine/userguide/networking/default_network/custom-docker0/

Create a docker-compose-overrides.yml if one doesn't exist in /opt/sk4 OR /opt/exabeam/data/sk4.

For Exabeam deployments. if the file did not exist previously, it should be referenced in the systemd unit of Exabeam Cloud Connectors in /etc/systemd/system/sk4compose.service, like so:

Make sure to adjust the path of the overrides file to your deployment.

Add an entry to the overrides file to specify the desired subnet.

Make sure the subnet does not collide with the bridge0 subnet.

For an example of full docker-compose-overrides.yml, see:

version: '3'
networks:
isolated_nw:
driver: bridge
ipam:
config:
- subnet: 192.167.0.0/16

This file is Indention sensitive. Copy and paste the above and modify the values to avoid indention issues.

If you changed the systemd unit, reload the systemd daemon: sudo systemctl daemon-reload

Restart the Exabeam Cloud Connectors service to take effect: sudo systemctl restart sk4compose

Verify it worked by running:

sudo docker inspect $(sudo docker container ls -q) | grep \"IPAddress\"

All the IP addresses should be in the subnet.

ipam source: https://docs.docker.com/compose/compose-file/#ipam

Stop the sk4compose service.

systemctl stop sk4compose

Copy volumes data from current root directory (SRC_VOLUMES_DIR) to a new existing root directory (DST_VOLUMES_DIR).

rsync -aP SRC_VOLUMES_DIR DST_VOLUMES_DIR

Change the directory to the Exabeam Cloud Connectors base directory where the docker-compose.yml is located, by default either /opt/sk4 or /opt/exabeam/data/sk4. You can find its location by examining the Exabeam Cloud Connector’s service file /etc/systemd/system/sk4compose.service.

Back up docker-compose.yml.

cp docker-compose.yml docker-compose.yml.bak

Update volumes mounted directory in the docker-compose.yml (replace DST_VOLUMES_DIR).

docker run --rm -v `pwd`/docker-compose.yml:/sk4/docker-compose.yml "498895000136.dkr.ecr.us-east-1.amazonaws.com/upgrade-scripts:1.0.0" node map_volumes_to_dir.js -f /sk4/docker-compose.yml -d DST_VOLUMES_DIR

Verify that indeed all volumes are now mounted to the DST_VOLUMES_DIR.

grep device: docker-compose.yml

Delete Exabeam Cloud Connectors docker volumes (this operation will not delete the actual data stored in SRC_VOLUMES_DIR)

docker volume rm $(docker volume ls -q | grep sk4_) -f

Restart the Exabeam Cloud Connectors service.

systemctl start sk4compose

To verify Exabeam Cloud Connectors is working properly, log in to the web interface and verify that all the accounts are still visible.

Delete the previously mounted directories from SRC_VOLUMES_DIR.

Stop the sk4compose service.

systemctl stop sk4compose

Copy volumes data from current docker volumes root directory (SRC_VOLUMES_DIR) to the new root directory (DST_VOLUMES_DIR).

# REPLACE SRC_VOLUMES_DIR with docker's volumes root directory (by default its /var/lib/docker/volumes)
_volumesDir=SRC_VOLUMES_DIR

# REPLACE DST_VOLUMES_DIR with the mounted directory in which you want all Exabeam Cloud Connectors data to be stored
_newMountedDir=DST_VOLUMES_DIR

_volumePathSize=${#_volumesDir}
for _dirName in $_volumesDir/sk4*; do
    _srcDir="${_dirName}/_data/"
    # volume name starts at _volumePathSize + length("/sk4_") + 1 
    _ind=$(($_volumePathSize+6))
    _dstDir=$_newMountedDir/$(echo $_dirName | cut -c$_ind-${#_dirName} | sed 's/sk4_//g')
    mkdir -p $_dstDir
    echo "Copy data from $_srcDir to $_dstDir"
    rsync -aP $_srcDir $_dstDir
done

Change directory to Exabeam Cloud Connectors base directory where the docker-compose.yml is located in /opt/sk4 (default) or /opt/exabeam/data/sk4. You can find its location by looking at the Exabeam Cloud Connector’s service file /etc/systemd/system/sk4compose.service.

Verify that indeed all volumes data was copied from SRC_VOLUMES_DIR to DST_VOLUMES_DIR. As an extra measure of precaution we recommend to backup the sk4_conf, the sk4_zoo_data and the sk4_zoo_datalog mounted points.

tar -zcvf conf_volume.tar.gz `docker volume inspect --format='{{.Mountpoint}}' sk4_conf`
tar -zcvf zoo_data_volume.tar.gz `docker volume inspect --format='{{.Mountpoint}}' sk4_zoo_data`
tar -zcvf zoo_datalog_volume.tar.gz `docker volume inspect --format='{{.Mountpoint}}' sk4_zoo_datalog`

Back up docker-compose.yml.

cp docker-compose.yml docker-compose.yml.bak

Update volumes mounted directory in the docker-compose.yml (replace DST_VOLUMES_DIR).

docker run --rm -v `pwd`/docker-compose.yml:/sk4/docker-compose.yml "498895000136.dkr.ecr.us-east-1.amazonaws.com/upgrade-scripts:1.0.0" node map_volumes_to_dir.js -f /sk4/docker-compose.yml -d DST_VOLUMES_DIR

Verify that indeed all volumes are now mounted to the DST_VOLUMES_DIR.

grep device: docker-compose.yml

Delete Exabeam Cloud Connectors docker volumes.

docker volume rm $(docker volume ls -q | grep sk4_) -f

Restart the Exabeam Cloud Connectors service.

systemctl start sk4compose

To verify Exabeam Cloud Connectors is properly working, log in to the web UI and verify that all the accounts are still visible.

You can now delete backup archives created in step 4.