Onboarding guide
This guide takes a new customer from an imported VM to a first investigation. It is written for the person doing the deployment and for the people who will grant access in Microsoft, Active Directory, CrowdStrike, Sophos or Zscaler. Each step links to the page that covers it in detail.
Before you start
Have these ready. Most delays in a first deployment come from waiting on one of them.
| Item | Why | Where it is documented |
|---|---|---|
| A hypervisor and the VM image for it | The appliance is a sealed VM. There is no installer and no SSH. | Setup Guide, VMware Fusion, Proxmox VE |
| Network access from the VM | Outbound HTTPS to the services you will use; LDAP, Kerberos and WinRM to your domain controllers if you use Active Directory. | Network Requirements |
| A product key, or a decision to start on the Community Edition | Activation runs on the appliance and does not need internet access. A 14-day Professional trial exists in the licensing service but nothing in the current interface starts it; ask support if you need one. | Configuring the appliance |
| Someone who can grant admin consent in your Microsoft tenant | The Microsoft connectors use an app registration with application permissions, which only a Global Administrator or Privileged Role Administrator can consent to. One registration can serve every connector. | Microsoft Entra ID app registration |
| An Active Directory service account | CICADA reads the directory over LDAP and collects event logs over WinRM with one account. Domain Admin is not required. | Active Directory account, Active Directory onboarding |
| EDR API credentials | A CrowdStrike API client, Sophos Taegis client credentials, or Zscaler ZIA client credentials. | CrowdStrike Falcon, Sophos Taegis, Zscaler ZIA |
| Threat intelligence API keys (optional) | Without keys, indicators are shown as not checked rather than clean. | Threat intelligence providers |
| An LLM: a local Ollama host or a cloud API key (optional) | The local model cannot run on the appliance itself. It needs its own host. | Local LLM & AI Setup, AI and local LLM |
Order of work
- Import and boot the VM. Follow the page for your hypervisor: Setup Guide, VMware Fusion or Proxmox VE.
- Set the network on the console. The first boot opens a network wizard on the VM console. Set the hostname and either keep DHCP or enter a static address. See first boot.
- Sign in by IP address and finish the setup wizard. EULA, licence, the first admin user, network and proxy. See the setup wizard.
- Make the appliance fit your environment. Allowed host names, your own TLS certificate, the outbound proxy, users and roles, MFA, single sign-on, backups. All under Settings. See Configuring the appliance.
- Have the access created on the customer side. The Microsoft app registration, the Active Directory service account and WinRM, the CrowdStrike API client, the Taegis client or the Zscaler ZIA client. These steps are done by the customer's own admins and can run in parallel with steps 1 to 4.
- Connect the data sources from the Sources page inside an investigation and press Test Connection on each one.
- Add threat intelligence keys and an LLM if you will use them.
- Run the first investigation end to end: First investigation checklist.
Pages in this guide
| Page | Covers |
|---|---|
| Configuring the appliance | First boot, the console network wizard, signing in, the setup wizard, allowed host names, product key, proxy, TLS, users and roles, MFA, personal access tokens, SSO, backups |
| Users and roles | The Roles page, the permissions each built-in role has, creating and editing roles, letting a help-desk role manage users, SSO role mapping, role order, what changed after the update |
| Microsoft Entra ID app registration | The app registration and every Microsoft Graph and Defender permission CICADA asks for, by connector, with the response actions that need write access |
| Active Directory | Password, Kerberos and keytab modes, ports, WinRM on domain controllers and servers, what is collected, response actions |
| CrowdStrike Falcon | API client, scopes, region URLs, what is collected, containment |
| Sophos Taegis | Client credentials, region, tenant, alerts and assets, isolation |
| Zscaler ZIA | API client, ZIA role, blocklist, what CICADA will and will not remove |
| Other sources | Event log, log file and PCAP uploads, the syslog receiver, DNS, DHCP and web logs, Varonis, BigID, Purview, the Kali tools sandbox |
| Threat intelligence providers | Where keys go, which providers exist, and what the three enrichment states mean |
| AI and local LLM | Ollama on a separate host, cloud providers, the endpoint policy, model approval |
| First investigation checklist | Create, add sources, test, collect, analyse, report, and where warnings appear |
When something fails
The Troubleshooting page covers the web interface, licence activation, the Microsoft, CrowdStrike and Active Directory connections, threat intelligence and AI. The connector pages in this guide (Active Directory, CrowdStrike, Sophos Taegis, Zscaler ZIA) also say what their Test Connection messages mean.