Problem installing a new IDH node with the SO installer 2.3.140

[b-u-g-s]

Hi,
I am trying to create an IDH node with the SO 2.3.140 installer, but whatever I select when I boot the ISO, I only sendup with a standard installation and the setup menu does not let me select an IDH installation.

More info:

• I have a manager installed in a VM as a standalone on an HYPER-V server
• I then create a new VM on the same HYPER-V server and give it the minimum required (1Gb, 2 CPU, 100Gb, 1x LAN)
• I boot the new VM with the SO 2.3.140 ISO mounted
• I can see the boot menu, I select INSTALL SECURITY ONION 2.3.140 IDH Node

This goes through what looks like a "standard" installation (meaning quite long with 1007 or so modules to install (which doesn't seem right for just a honeypot, but maybe that's normal)
The VM reboots
I log in
I get the setup menu, but that's the standard setup menu which only allow me to install an EVAL, STANDALONE, etc...
If I select OTHER, I don't get any IDH option

Looks to me as if the ISO boot menu does not actually take my choice in consideration and just install the standard SO 2.3.140

I also tried the install IDH node in basic graphics mode and I was getting the same install process so I cancelled.

The doc:
https://docs.securityonion.net/en/2.3/idh.html#installation
Seems to indicate you can just use the SO ISO 2.3.140 to install an IDH (and the ISO boot menu looks like it can).

Am I missing something here?
Thanks.
Bugs

[isaacgolding]

Is your VM defaulting back to the installer ISO to boot from? If so unmount the ISO and boot.

[dougburks]

For others that might find this discussion, the IDH setup process is documented here:
https://docs.securityonion.net/en/2.3/idh.html#screenshots

[b-u-g-s]

Thanks Doug. For me there was one screenshot missing on that page which would have helped: A first screenshot of when you select DISTRIBUTED. It might be obvious for some, but if this is the first time you setup a node it might not be obvious.
Also, it would be great if when selecting "install IDH" at boot, you are then presented with a different menu than the standard install. From the doc I understand it partitions the disk differently, but is there a case for installing anything else than a distributed IDH node after selecting "install IDH" at boot? would someone select standalone or eval?

[dougburks]

For me there was one screenshot missing on that page which would have helped: A first screenshot of when you select DISTRIBUTED. It might be obvious for some, but if this is the first time you setup a node it might not be obvious.

From https://docs.securityonion.net/en/2.3/idh.html#screenshots:
Run Setup, choose to add a new node to your distributed deployment, and then select the IDH option.

If you would like to suggest alternate wording to make that more obvious, I'm happy to update it.

[b-u-g-s]

What about something like that:
"Run Setup, select the DISTRIBUTED install submenu, choose to add a new node to your existing deployment, and then select the IDH option."

[dougburks]

Done.