What are the system requirements for installing CYFOX?
At least 8 CPU cores.
32 Gigabytes of memory (RAM).
A hard drive of 1024 Gigabytes.
2 network interfaces:
One interface for scanning (in case of multiple VLANs, the system must be connected to a trunk IEEE 802.1Q containing all the VLANs to scan).
The second interface is for IDS and must be dedicated to the system – connected to the central switch that supports Port Mirroring to receive traffic duplication for early detection of suspicious behavior.
What are the network setting requirements?
IP address, subnet mask, and default gateway for system management.
In the case of multiple VLANs: IP address, subnet mask, and VLAN ID are required for each VLAN.
It is recommended that the management address will be in the native VLAN.
Ensure access to the core switch (user/password) to configure various settings (port mirroring, etc.).
Identify the port from which the backbone is connected to the firewall.
A free port must be assigned in the core switch for the port mirroring configuration.
CYFOX communicates with the license and updates servers regularly; add Firewall rules (if necessary) to allow access to the following addresses on ports 80 and 443 TCP: 82.166.80.236 and 62.90.227.179.
What are the GPO settings for CYFOX?
CYFOX can access Microsoft devices directly through WMI.
GPO must be configured on the Domain Controller to enable WMI access across all hosts.
Additionally, a user with admin privileges in the domain for CYFOX should be prepared.
What are the CYFOX settings for managed SOC services?
For SOC services (if acquired), please open UDP port 2514 from the CYFOX server to 31.133.100.151.
How do I download and install CYFOX?
Download and install CYFOX from the provided link.
For an initial/extended license, please get in touch with our sales team at [email protected].
The ISO should also be uploaded to the ESXi Datastore for installation.
What access is required for the CYFOX support team?
To allow access for support and maintenance, open ports 22 and 7443 TCP for addresses 212.150.108.5 and 62.0.131.49 to the CYFOX server in your Firewall.
If the ports are already in use by VIP, you can port forward to other ports and update us.
After partial installation, I got a black screen.
Ensure the hard drive where CYFOX is installed is at least 1024 Gigabytes and bootable. If this is properly set, wait 30 minutes to an hour for the system to load fully.
What should I do if there are mutual detections between CYFOX and other security products?
If you experience mutual detections between CYFOX and other security products, you should exclude the following CYFOX processes from the other security products:
C:\Program Files\Cyfox\Cyfox Agent\cfx.exe
C:\Program Files\Cyfox\Cyfox Agent\cfxhelper.exe
Additionally, to prevent network detections at the IDS level, ensure that the internal address of the CYFOX server is excluded.