Standalone Sensor update/migration to HeavyNode GRID

[virginiait]

We are prepping for a distributed GRID setup using 2.3.200 having one (1) ManagerSearch Node and several (1+) Heavy Nodes at several offices. At a few of those offices, we currently have Standalone sensors (SensorManager - single box) running 2.3.160/170 which we would like to bring into the GRID without losing their historical PCAP and Zeek Logs.

Questions.

1. How to bring Standalone 2.3.160/170 Sensors into the 2.3.200 GRID – Are we able to use the 2.3.200 ISO and "migrate/update" our current Standalone sensors into the SecOnion 2.3.190 GRID as a HeavyNode without requiring a full rebuild/wipe of the Standalone Sensor or loosing existing PCAP or Zeek Logs Metadata?

• Assuming the 2.3.160 and 170 will update to that of the 2.3.200 during this process.
• Attempting to keep the historical PCAP and Metadata intact and available once it’s brought into the GRID.

2. Build and Deployment scenario – Is there an option that would allow us to prebuild/configure the 2.3.200 HeavyNodes in our Lab, "without" having been connected to the GRIDs production ManagerNode – getting it as close to plug'n-play as possible once it (HeavyNode) arrives at the remote office?

• For our distributed GRID we're building: We must deploy sensors (to be added to the GRID later) to remote offices. However, we're looking to pre-build the (HeavyNodes) sensors in our Lab - "without" connecting it to the production ManagerSearch node - prior to shipping.
• Ideally, connecting the HeavyNode sensor to the production ManagerSearch Node in the GRID would be done, once the HeavyNode sensors arrives at our remote offices.

Thanks in advance.

[rosswakelin]

Hi. We also have a geographically distributed set of sensor nodes. What we do is pre-configure the sensor nodes by running the ISO install on the node, then rebooting it and ONLY running the network setup portion, setting the network to be correct for the eventual location of the sensor. We then ship the sensor and get the on-site techs to rack and stack. Once its turned on, we can SSH to the sensor node and run the normal setup routine to add it to the grid.
We are getting nervous about the eventual release of 2.4, with its underlying OS upgrade, and how this will work on our remote sensors (most of them need a flight to get to them, and soon we will have some 12 hours flying away in another country)