Skip to main content

NFS

The initial minimal deployment deploys without a Network File Share (NFS). Enabling an NFS allows Darktrace to keep a copy of every file processed on disk. This enables the re-running of analysis and the downloading of the original file in the UI for further analysis.

Prerequisites​

  • The VPC and subnet you used in the initial deployment
  • The security group you used in the initial deployment, and permission to edit it

Steps​

  1. Configure inbound Security Group rules. Use security group id as Custom Source
TypePortSourceReason
Custom TCP2049Custom - Your / Forensic Acquisition and Investigation security groupCommunicating with NFS
  1. Navigate to the EFS page in AWS Console
  2. Click “Create file system”
  3. Select your VPC from step 1, then press “Customize”.

AWS Create FS

  1. Leave defaults unchanged for General, Performance settings and Tags. Click Next.

  2. On the Network Access page

    a. Under Virtual Private Cloud (VPC): Select the VPC where your instance is deployed.

    b. Under mount targets: Create a mount target using the subnet and security group your instance is deployed with

AWS Network Access

  1. Leave the File system policy settings unchanged. Click Next.
  2. On the Review and Create page: click "Create"
  3. On the last page, confirm the settings are correct, then press “Create”.
  4. Select the filesystem ID of the newly created filesystem and open the access points tab.

AWS FS Overview

  1. Create a new access point with the following settings:

    a. Under Details, set Root directory path to /process.

    AWS Details

    b. Under POSIX user:
    i. Set User ID to 0.
    ii. Set Group ID to 0.

    AWS POSIX

    c. Under Root directory creation permissions:
    i. Set Owner user ID to 0.
    ii. Set Owner group ID to 0.
    iii. Set Access point permissions to 0755.

    AWS Root Permission

  2. Click Create

  3. For the file system go to the Network tab and make a note of the ip address for the availability zone your VM is in

AWS AZ

  1. Once the access point and mount target have finished creation, Mount in the UI (Settings > Advanced > NFS > Setup NFS) using the ip address of the mount target:

AWS NFS