Setup Guide
CICADA IR is distributed as a virtual machine image compatible with all major hypervisors. This guide covers deployment on VMware, VirtualBox, Hyper-V, and Proxmox.
Image formats
| Hypervisor | Format | File |
|---|---|---|
| VMware ESXi / Workstation | OVA | cicada-ir-<version>.ova |
| VirtualBox | OVA | cicada-ir-<version>.ova |
| Hyper-V | VHDX | cicada-ir-<version>.vhdx |
| Proxmox / KVM | QCOW2 | cicada-ir-<version>.qcow2 |
If you need a format not listed, you can convert between formats using qemu-img:
# QCOW2 to VMDK (for VMware)
qemu-img convert -f qcow2 -O vmdk cicada-ir-latest.qcow2 cicada-ir-latest.vmdk
# QCOW2 to VHDX (for Hyper-V)
qemu-img convert -f qcow2 -O vhdx cicada-ir-latest.qcow2 cicada-ir-latest.vhdxVMware ESXi
Import via vSphere Client
- Log in to your vSphere Client
- Right-click your target host or cluster and select Deploy OVF Template
- Select Local file and browse to the OVA file
- Follow the wizard:
- Name:
cicada-ir(or your preferred name) - Storage: Select the appropriate datastore (minimum 40 GB free)
- Network: Select the management network the VM should use
- Name:
- Review settings and click Finish
- Edit the VM settings to adjust CPU/RAM (recommended: 4 vCPUs, 8 GB RAM)
- Power on the VM
VMware Workstation
- Open VMware Workstation
- Go to File > Open and select the
.ovafile - Choose an import location and click Import
- Adjust hardware settings if needed (right-click VM > Settings)
- Start the VM
VirtualBox
Import via GUI
- Open VirtualBox Manager
- Go to File > Import Appliance
- Browse to the OVA file and click Next
- Review appliance settings:
- Adjust CPU and RAM if needed (recommended: 4 CPUs, 8192 MB)
- Set Network Adapter to Bridged Adapter for direct network access, or NAT if you want the VM behind the host's network
- Click Import
- Start the VM
Import via CLI
# Import the OVA
VBoxManage import cicada-ir-latest.ova --vsys 0 --vmname "cicada-ir"
# Optionally adjust resources
VBoxManage modifyvm "cicada-ir" --memory 8192 --cpus 4
# Set network to bridged (replace en0 with your interface)
VBoxManage modifyvm "cicada-ir" --nic1 bridged --bridgeadapter1 en0
# Start the VM
VBoxManage startvm "cicada-ir" --type headlessHyper-V
Import via Hyper-V Manager
- Open Hyper-V Manager
- Click Action > New > Virtual Machine
- Follow the wizard:
- Name:
cicada-ir - Generation: Generation 2 (UEFI)
- Memory: 8192 MB (minimum 4096 MB)
- Network: Select your management virtual switch
- Virtual Hard Disk: Select Use an existing virtual hard disk and browse to the
.vhdxfile
- Name:
- Before starting, go to VM Settings:
- Security: Disable Secure Boot (or set to Microsoft UEFI Certificate Authority template)
- Processor: Set to 4 virtual processors
- Start the VM
Import via PowerShell
# Create a new VM using the existing disk
New-VM -Name "cicada-ir" `
-MemoryStartupBytes 8GB `
-VHDPath "C:\VMs\cicada-ir-latest.vhdx" `
-Generation 2 `
-SwitchName "Default Switch"
# Configure CPU
Set-VMProcessor -VMName "cicada-ir" -Count 4
# Disable Secure Boot for Linux
Set-VMFirmware -VMName "cicada-ir" -EnableSecureBoot Off
# Start the VM
Start-VM -Name "cicada-ir"
# Get the VM's IP address
Get-VMNetworkAdapter -VMName "cicada-ir" | Select IPAddressesProxmox VE
Import via Web UI
Upload the QCOW2 file to your Proxmox storage:
# From the Proxmox host shell
scp cicada-ir-latest.qcow2 root@proxmox:/var/lib/vz/images/Create a new VM in the Proxmox web UI:
- General: Name it
cicada-ir, set VM ID - OS: Select Do not use any media (we will import the disk)
- System: BIOS: OVMF (UEFI), Machine: q35
- Disks: Delete the default disk (we will import)
- CPU: 4 cores
- Memory: 8192 MB
- Network: Select your bridge (e.g.,
vmbr0)
Import the disk:
# Import the QCOW2 as the VM's primary disk (replace 100 with your VM ID)
qm importdisk 100 /var/lib/vz/images/cicada-ir-latest.qcow2 local-lvm
# Attach the imported disk
qm set 100 --scsi0 local-lvm:vm-100-disk-0
qm set 100 --boot order=scsi0Start the VM from the web UI.
Import via CLI
# Create the VM
qm create 100 --name cicada-ir --memory 8192 --cores 4 --net0 virtio,bridge=vmbr0
# Import disk
qm importdisk 100 cicada-ir-latest.qcow2 local-lvm
# Configure boot disk
qm set 100 --scsi0 local-lvm:vm-100-disk-0
qm set 100 --boot order=scsi0
qm set 100 --scsihw virtio-scsi-single
# Start
qm start 100Post-deployment steps
After deploying on any platform:
- Find the IP address — Log in to the VM console with the
cicada-adminuser and runip addr show - Access the web UI — Open
https://<vm-ip>in your browser - Activate your license — See Getting Started
- Replace the TLS certificate — For production deployments, replace the self-signed certificate (see TLS setup)
- Configure firewall rules — Whitelist the FQDNs listed in Network Requirements
- Set a static IP — For production, configure a static IP via netplan
Static IP configuration example:
sudo nano /etc/netplan/01-netcfg.yamlnetwork:
version: 2
ethernets:
ens18:
addresses:
- 192.168.1.100/24
routes:
- to: default
via: 192.168.1.1
nameservers:
addresses:
- 8.8.8.8
- 8.8.4.4sudo netplan applyResource tuning
| Scenario | vCPUs | RAM | Disk |
|---|---|---|---|
| Small team (1–3 analysts, < 5 investigations) | 2 | 4 GB | 20 GB |
| Medium team (3–10 analysts, 5–20 investigations) | 4 | 8 GB | 40 GB |
| Large team (10+ analysts, 20+ investigations) | 8 | 16 GB | 100 GB |