I’ve been using Connectwise SIEM since way back before Connectwise owned it and it was Perch Security. Recently I’ve been in a transition period where I’ve been moving from VMware to Proxmox since Broadcom has always been clear that they don’t care about their smaller customers, and I’ve always been a fan of supporting open-source projects over the commercial ones anyway. It’s been going great – except for the fact that Connectwise doesn’t have an appliance for Proxmox.

I decided to figure it out myself! Turns out, it was actually fairly easy thanks to the help of a few online resources that had already figured out a few of the pieces for me. I figured I would publish a step by step guide in the hopes that it would help someone else as well.

1. If you haven’t already, log into https://app.perchsecurity.com and select the customer you wish to install the sensor for.
2. Navigate to Settings -> Network -> Sensors
3. Download the image for VMWare from the top links.
4. While this is downloading, log into Proxmox.
   1. Navigate to the node’s Shell and as root run “apt-get install openvswitch-switch” (If you haven’t already installed openvswitch)
   2. Confirm the request if necessary
   3. Navigate to System->Network under your node.
   4. Setup your normal networking if you haven’t already.
   5. Identify the network interface you will be using for you span port… note that this interface must be dedicated to this purpose and connected to a switchport in mirroring/span mode.
   6. Create a new OVS Bridge. I named mine “span”, but you can name it whatever you like.
      1. Leave all fields blank, except check “Autostart” and under “Bridge ports” enter the name of the network interface you are using for the spanning.
      2. Add an optional comment if you want
      3. Click “Create.
5. Identify the vm ID you plan to use (it must be a unique number not running anywhere else in your cluster – if you aren’t sure, click “Create VM” in the web interface, note the VM ID, and cancel out of that dialog)
6. Also identify the name of the datastore you plan to use for the disk storage
7. Check if your .ova download has finished, otherwise wait for that.
8. Behind the scenes an .ova is a compressed file containing the relevant files from a VMWare machine. Use 7-Zip or another applicable tool to extract the archive to a new folder looking for these 3 files.
9. Use SCP or SFTP (ie. WinSCP) to transfer these extracted files to your Proxmox server via SSH.
10. Using the shell web interface (or preferrably by logging into your node via SSH since some of these steps may take a few minutes, and navigating away from your shell in the web interface will lose your progress – it is just for quick tasks), navigate to the directory you uploaded the extracted files.
11. From this directory, run the command “qm importovf [VM ID] [.ovf name – mine was vm-v3.0.7-240611.ovf] [name of disk store]”
12. Wait for this process to complete, it may take a minute. Once it does, you should see the VM ID you specified running on your node. Mine also had “ConnectWiseSensor” as the name, but this is subject to change. (You can change it in the VM options if you want.)
13. Select the VM, go to the “Hardware” tab.
14. Click “Add”->”Network Device”
15. Select your regular networking bridge, not the span networking bridge.
16. Change the “Model” to “VMWare vmxnet3”, and if desired, set the VLAN, MAC Address, and Firewall settings you want to use for the management interface of the sensor.
17. Click “Add”
18. Again we are going to click “Add”->”Network Device”
19. This time we will select the span bridge (or whatever you named it).
20. Change the “Model” to “VMWare vmxnet3”. You will need to leave the VLAN blank, should probably leave MAC address blank, and should uncheck “Firewall”.
21. Click “Add”
22. Now go into the “Console” tab and start the VM up.
23. While the VM is booting up, return to your node’s shell or SSH window (I really suggest using SSH for this next part – credit to this part goes to vext and his blog post here).
24. From your node’s CLI run “ovs-vsctl — –id@p get port tap[VM ID]i1 \
    — –id=@m create mirror name=span1 select-all=true output-port=@p
    — set bridge [span bridge name – mine was just “span”] mirrors=@m”
25. Go back to the console and log in with the information provided in Connectwise’s documentation.
26. During the configuration, it will ask which network interface is used for cloud connection. It should be the lowest numbered interface. The other higher numbered interface should be used for the span port. (It said 0 packets for me, don’t worry about it at that point.)
27. Once configuration is complete, log into the prairiefire user (to change the default password per best practices)
28. Unofficially you can install ifstat using “sudo apt-get install ifstat” and run it to check the packet counts coming in to confirm the interfaces are working as expected and you selected the right one during configuration.
29. Go to Perchybana, select an index related to the sensor (I recommend TLS records), and make sure you are seeing traffic from the sensor within a few minutes of running it.
30. There is one catch, the command we used to ensure the port was passing through the span traffic does not survive a reboot as pointed out by vext. To solve this, we’ll use a modified version of the script he created.
    1. On your node’s CLI, navigate to /root
    2. Use your favorite text editor (real IT people us vim BTW) to create the following script “/root/mirror_config.sh”:
       “#!/bin/bash
       ovs-vsctl clear bridge [span] mirrors
       ovs-vsctl — –id@p get port tap[VM ID]i1 \
       — –id=@m create mirror name=span1 select-all=true output-port=@p
       — set bridge [span bridge name – mine was just “span”] mirrors=@m”
    3. Run “chmod +x mirror_config.sh”
    4. Run crontab -e and add the following line:
       @reboot sleep 60 && /root/mirror_config.sh
    5. Edit your VM options to ensure “Start at boot” is checked, and that the machine starts fairly early on in the startup sequence as it must be running for this to work properly.