Home General
Category:

General

BackupCloudDatacenterGeneralSecuritySoftwareStorage

Commvault Launch Event – Accelerating Cyber Defense and Response with Next-Generation Data Protection

by Shawn Cannon
written by Shawn Cannon

On June 7th, Commvault held an online event called Accelerating Cyber Defense and Response with Next-Generation Data Protection. During this event, Commvault announced some exciting new products and updates. Here is what was announced.

Commvault ThreatWise (New Updates)

First, what is Commvault ThreatWise? The Commvault ThreatWise solution allows an organization to actively defend their data with fully-integrated cyber deception. This allows them to uncover, contain, and minimize threats the moment a ransomware attack begins.

The new addition is called ThreatWise Advisor. ThreatWise Advisor intelligently recommends sensor placement by continuously assessing workloads protected in backup environments and suggesting what decoys to configure (and where) to further safeguard these workloads.

Commvault Threat Scan (New)

The Commvault Threat Scan solution allows Operations teams can take control and defend their backup data by proactively identifying malware threats to avoid reinfection during recovery. Commvault Threat Scan analyzes backup data to find encrypted or corrupted files, ensuring users recover trusted versions of their data quickly.

This solution addresses the customer challenge of not having insight into malware & ransomware attacks at the early stages, such as when files are being encrypted or corrupted. These attacks can cause greater damage to a company – leading to longer recovery times.

Commvault Risk Analysis (New)

Commvault Risk Analysis helps organizations effortlessly identify and secure sensitive data across their entire infrastructure. They gain visibility into data risks, collaborate, and mitigate potential data breaches, all while saving costs through smart data management strategies.

This solution addresses the customer challenge of ITOps and SecOps teams not having an easy way to identify the classification of data, its age, or usefulness to the organization.

Commvault Auto Recovery (formally known as Disaster Recovery with New Updates)

Commvault Auto Recovery provides a single platform that can protect and securely recover applications. Auto Recovery provides customers the ability to protect all applications, not just mission critical apps, with secure verifiable recovery with the lowest TCO.

This solution addresses the customer challenge of needing a way to securely recover their applications when disaster or cyberattacks strike with minimal disruption to the business. Traditionally, this is done with expensive hardware that is cost prohibitive for all but large enterprises. Smaller customers must rely on incomplete offerings from one or multiple vendors and stitch together a complete offering.

Commvault Cloud Command (New)

The Commvault Cloud Command solution allows customers to manage their entire Commvault Data Protection estate for both on-prem and SaaS through a single comprehensive SaaS-based UI, including security and data protection health dashboarding.

This solution addresses the customer challenge of navigating a complex landscape of data protection tools and platforms, ranging from on-premises to SaaS-based solutions. This complexity can be difficult and costly.

Partner Integrations (new)

Commvault announced some new integrations as well, including the SOAR integration with Microsoft Sentinel.

Commvault SOAR integrations provide an enhanced security posture and improved collaboration between Backup and Security Operations teams. Alerts and audit events are sent to the SOAR platform, so SecOp engineers can swiftly respond to anomalies or evidence of compromise while leveraging orchestrated actions to reduce incident response time.

Plugin is available for all Commvault software and Metallic bundles.

Another new integration is with the CyberArk Indentity Security Platform.

Commvault’s integration with the CyberArk Identity Security Platform significantly reduces the risk of credential theft with best-in-class integration that segments the credential storage away from the backup environments. This integration helps organizations follow strong zero trust architecture practices, deploy rigorous lifecycle credential policies, and comply with the most stringent regulations.

Plugin is available for all Commvault software and Metallic bundles.

Final Thoughts

As a consultant that has experience in the cybersecurity field, having a solution to help protect your company data is very important. Commvault has pulled out all the stops by providing a comprehensive platform across their ecosystem. All these new and updated solutions in their platform address the challenges most companies face. I expect Commvault to continue to be the leader in this space and will continue to innovate with their platform.

For more information on all of these product announcements and updates, check out the on-demand version of the event.

https://discover.commvault.com/Event-Security-Launch-Data-Protected-Registration.html

The press release can be read here: https://ir.commvault.com/news-releases/news-release-details/commvault-redefines-data-protection-new-security-capabilities.

View what’s new in the Commvault Platform here: https://www.commvault.com/platform/whats-new

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
Big DataGeneralSplunk

Splunk Blog Series – Deploying an App Via Deployment Server

by Shawn Cannon
written by Shawn Cannon

In the previous post in this series, I described how to setup an app for deploying HEC to multiple heavy forwarders. The best way to do this is via a deployment server. This is not a “deployer server”; a deployer is used to push apps to search head clusters. A deployment server is used to push apps to Splunk Universal Forwarders (UFs) and non clustered Splunk servers, like heavy forwarders. All Splunk Enterprise instances can be a deployment server. A universal forwarder cannot be a deployment server. To make a Splunk Enterprise server a deployment server, change into the /opt/splunk/etc/delpoyment-apps folder. In this folder, copy in the app you want to deploy out to servers. Here are the steps to create an app. I am going to show you the method of using the GUI so you can then see the resulting folder structure for a Splunk app.

On the server that will be the deployment server, go to Manage Apps. If you are on the launcher page, that will be the gear icon.

This will take you to the apps screen.  Once there, click on the Create App button at the right.

The following screen will appear.

Enter a name for the app (Ex:  Splunk HEC)
Enter a folder name (Note:  cannot use spaces.  Ex: splunk_hec)
Enter a version number (Ex: 1.0.0) – this is optional
Mark the app as visible or not.  If there is going to be dashboards and such for your app, make it visible, otherwise set this to No.
Enter an author name – this is optional
Enter a description – this is optional
Leave the template at Barebones and click Save at the bottom.

Now lets check out the app folder structure.  Go to the CLI and go into /opt/splunk/etc/apps (this is where new apps default to).  Change into the folder of the app you just created.

As you can see, 4 folders are created.  The Splunk best practice when creating a new app is to add your settings into the default folder so lets change into that folder.  In this scenario, we are going to create an inputs.conf file and paste in the HEC settings from the previous post.

Once the inputs.conf file is saved, move the app folder into the deployment-apps folder.

mv /opt/splunk/etc/apps/splunk_hec /opt/splunk/etc/deployment-apps

Now we will go into the Splunk GUI again on the server that will be the deployment server.  Click on Settings – Forwarder Management

Now you will get a screen similar to below.

Before moving that app into deployment-apps, this screen would have been blank.  As you can see, there is 1 app [Apps (1)].  There are no clients though.  Easy!  We need to tell the server we want to push the app to how to find the deployment server.  Normally you would set this in a template build of a new Splunk server (to automate it) but for this example you can run the following command:

/opt/splunk/bin/splunk set deploy-poll <deployment server name or IP>:8089

You are likely to be prompted for a username and password.  Enter a Splunk username/pass that has admin rights.  Once the command is complete, restart splunk.

/opt/splunk/bin/splunk restart

Once Splunk comes back up, in the Deployment Server page, this server should show up within a few minutes.

And there it is!  But we are not done!  There is another piece to this.  We need to create a server class.  A server class is how you assign clients to apps.  Click on Server Classes.

This server does not have any server classes yet to click create one.

Choose a name for the server class.  In this case, I used Splunk, HF for heavy forwarder and HEC since this will be for the new HEC app.  Click Save.

Lets add the server into Clients.  Click Add Clients.

Under the include section, you type in the server names that you want to be in this server class.  Once the servers are there, click Save.

Don’t add the app yet as we may want to make sure that Splunkd restarts are part of the app deploy.  Click on apps and Edit the app.

Check the box Restart Splunkd if you want Splunk to restart on deploy. I recommend checking this since this app will not go into effect without a restart of Splunk.  Under server classes, pick the server class we just created.  Click Save.

That’s it!  The app will deploy on the next poll from the client that was added into the server class.

You can force the client to check in and pull the app by using the command below.

/opt/splunk/bin/splunk reload deploy-server -class <server class name>

Oh, let’s check the server to see if the app now shows up

There it is!  You have successfully deployed an app using the deployment server!

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
DatacenterGeneralStorage

Reclaim dirty free space in Windows VMs by comparing Windows to vSphere reported free space

by Philip Sellers
written by Philip Sellers

Windows is dirty.  It has always been dirty.  It is an OS that doesn’t do a good job of cleaning up after itself.  And so, you may have a lot of unused, dirty space consumed in your environment that can be cleaned up.  When files are deleted, the OS leaves behind the actual data on its disk.  It does not take the time to zero out the space and that’s where the opportunity comes in.  PowerShell to the rescue.

vSphere has the ability to thin provision, but it doesn’t have the native ability to reclaim free space in a guest operating system.  To be able to reclaim your dirty free space, the first thing you’ll need is storage that can detect zeros and perform an unmap at the array level.

When vSphere introduced vSphere API’s for Array Integration (VAAI), it touted the unmap capability, but the backend arrays were not all able to keep up with the unmap commands happening in real time.  Instead, VMware turned off unmap for several versions of vSphere.  In vSphere 6.5, you have a simple on/off switch for the feature in vCenter.

But turning on the unmap feature does not solve the whole problem.  Inside of the guest OS, you also need to zero out the prior used space.  If you do not do this, the OS and hypervisor both see the space is used still.

PowerShell to the Rescue

So, the script below helps with this process.  It uses a PowerShell routine called Write-ZeroToFreeSpace from Chris Duck that you will need to download separately.

Then the routine below gets a list of all the VMs in vCenter and compares them to the free space reported by the Windows guest OS looking for large differences to help target which VMs to write zeros to in their free space.

Let me be the first to say that this is far from prefect – so please correct and expand on the code as you see fit.

Script

[code language=”powershell”]# Detect and thin out Windows disks
# Requires script to run as a privileged Windows account – like Domain Administrator
# Requires the Write-ZeroToFreeSpace script at http://blog.whatsupduck.net/2012/03/powershell-alternative-to-sdelete.html
# Wrap the Write-ZeroToFreeSpace script as a function – eg. Function Write-ZeroToFreeSpace { –content from website– }
# vCenter credentials can be separate if the same account does not have access to vCenter – you will be prompted for credentials for vCenter in that case

# — VARIABLES —
# Set the size in GB for threshold to be performed, 100GB default below
$ReclaimThreshold = 100
# Set the vCenter Server Name or IP address
$vCenterServer = "vcenter.local.domain"
# Connect to vCenter – will perform SSO, if available, or prompt for credentials, if not
connect-viserver $vCenterServer

# Target only VMs on arrays with thin provisioning capabilities – otherwise the process is a waste
# Examples of different ways to target VMs, as an example – all VMs in a vCenter – if your back end storage is all ZeroDetect or Thin capable
$targetVMs = Get-VM
# Get individual datastores that match pattern – can be VVOL datastores
# $targetVMs = Get-Datastore * | Get-VM
# Get a datastore cluster or clusters matching a pattern
# $targetVMs = Get-DatastoreCluster 3PAR*
# Get all VMs in a Cluster
# $targetVMs = Get-VM -Location (Get-Cluster ClusterName)

# Create a new object that lists the FreeSpace characteristics – limit to just Windows guests
$freespace = $targetVMs | Where {$_.Guest -like "*Win*"} | Select Name, UsedSpaceGB, ProvisionedSpaceGB, @{N="FreeSpaceVMwareGB";E={$_.ProvisionedSpaceGB – $_.UsedSpaceGB}}, @{N="FreeSpaceWindows";E={(Get-WmiObject Win32_LogicalDisk -ComputerName $_.Name | Where {$_.DriveType -eq 3} | Measure -Property FreeSpace -Sum).Sum}}

# Use the $freespace object and summarize
$reclaimable = $freespace | Select Name, @{N="TotalSpaceVMW";E={ [math]::Round($_.ProvisionedSpaceGB)}}, @{N="UsedSpaceVMW";E={ [math]::Round($_.UsedSpaceGB)}}, @{N="FreeSpaceVMW";E={ [math]::Round($_.FreeSpaceVMwareGB)}}, @{N="FreeSpaceWIN";E={ [math]::Round($_.FreeSpaceWindows / 1GB)}} | Where {$_.FreeSpaceVMW -ne 0 -AND $_.FreeSpaceWIN -ne 0}

# Add a final column called Reclaimable with the difference between Windows reported and VMware reported free space
$reclaimable = $reclaimable | Select *, @{N="Reclaimable";E={$_.FreeSpaceWIN – $_.FreeSpaceVMW}}

# Perform the cleanup
$reclaimable | sort -Property Reclaimable -DESC | Where {$_.Reclaimable -gt $ReclaimThreshold} | ForEach {
$computer = $_.name
$computer
$drives = Get-WmiObject Win32_LogicalDisk -ComputerName $_.Name | Where {$_.DriveType -eq 3}
$drives | Select DeviceID | FT
$drives | ForEach {
Write-Host "Zeroing disk space on drive "$_.DeviceID
Invoke-Command -Computer $computer -ScriptBlock ${function:\Write-ZeroToFreeSpace} -ArgumentList $_.DeviceID,.01
}
}
[/code]

Utilized the Write-ZeroToFreeSpace script from Chris Duck. http://blog.whatsupduck.net/2012/03/powershell-alternative-to-sdelete.html

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
General

Dropcam celebrating its 4th birthday with a giveaway

by Philip Sellers
written by Philip Sellers

clickDropcam, the maker of the awesome IP camera and DVR service, is celebrating its 4th birthday and to celebrate, they’re giving away a free Dropcam or a year of Dropcam DVR service each day for the next 7 days.  Get all the details on how to enter the contest over at Dropcam’s Facebook page or at this email newsletter I received.

I had been eyeing a Dropcam for a long time and finally purchased one on Cyber Monday.  I LOVE my Dropcam.  My wife and I just had a baby and so the Dropcam is setup so that I can visit with mom and baby during the day when I go back to work later this week.  It is perfect because I can see high definition video of our newborn and mom and peek in on them from work.  We have also used it to keep and eye on him from our iPhone next to the bed – our baby monitor for now.  Its been great to watch him while he sleeps and we do chores around the house.

After we finish using it as a baby cam, we are going to permanently mount it in our living room to be a security camera.  Two times last year while we were away on a trip, our security system has gone off and we were two time zones away with no way to know what was going on in our home.  With Dropcam, that won’t be the case anymore.  We will be able quickly pull up live video of our home and even get motion alerts from inside our home when we are away.  Best of all, the app and setup of the camera was extremely simple – you could tell it was designed for real people, not just geeks.  Even though I’m technical, I appreciated the simplicity.  But simplicity doesn’t mean lack of functionality  either.  The Dropcam is full featured and includes the ability to digitally zoom the camera, the ability to enable or disable the microphone, the ability to talk back through the camera and the ability to enable or disable infrared, night vision (or set it to auto and let the cam decide).

The Dropcam website is dead simple to use just like the iPhone/Android app.  You can visit and see heads up of multiple Dropcams if you have more than one registered in your account.  Anyways, this is a product I love.

Dropcam GiveawayDropcam did not request and is in no way sponsoring this post – these impressions are my own.  Dropcam did not send me a free cam – I bought the one that I’m gushing about and I genuinely think its a fantastic IP camera and service.  (I won’t turn away anything Dropcam may send my way, though!)

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
General

Integrity and standards for the new world

by Philip Sellers
written by Philip Sellers

Blogging is fantastic for a number of reasons.  It provides anyone, regardless of affiliation, with the ability to voice what they feel, observe and believe.  The growth of blogs or citizen journalism has provided writers with the ability to disseminate their work without the need for a vehicle like traditional newspapers and magazines.  At the same time that it has leveled the playing field, it has also made it easy for people without good intentions to disseminate hatred and misinformation with the express purpose of hurting rivals or anyone who does not agree.

It is the shady side that hurts the legitimacy of all bloggers.  With traditional journalists, there is a code of ethics and standards and anyone who does not abide by those standards is black-balled and fired.  In the blogging world, the journalistic standards are not enforced and the sensational, tabloid world, where dirt and all-out lies sell issues, has made it over into the blogosphere.  Even worse, people pose as someone they are not in order to persuade and influence decisions of readers.

Continue Reading
0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
General

My best blogging experience so far, the Bloggers Reality Contest

by Philip Sellers
written by Philip Sellers

The past month has been one of the most fun and challenging things since I started blogging.  I have been participating with Thomas Jones’ Bloggers Reality Contest.  We posted our third and final posts of the contest last week and each of us has been patiently waiting for the final results this week at VMworld.

On Monday, we all took part in an interview on VMware Community TV, which you can watch on-demand at the bottom of this post.  The interview was fun and included our sponsors, the contestants and our judges.  From the sounds of the interview, we all grew and learned out of this experience.

Last night, we had a fantastic wrap dinner with everyone involved and our sponsors and our winners and prizes were awarded.  Congrats to Luigi Danakos (@Nerdblurt), the winner of the Gold bracket, and to Michael Letschin (@mletschin), the winner of the Silver bracket.  Both of these guys did a tremendous job during the contest and I think we have all learned from each other on how we approach our posts and tips and tricks we have learned along the way.  You can see a full recap from Thomas on his site, NikeTown588.

And, as a recap, I wanted to provide some of the highlights I found in the competition:

1) Professional Judges Feedback – Quite possibly, this is the biggest, long-term benefit of the competition.

2) Discovery  – I have ‘met’ a lot of people online thanks to this competition.  A good thing about participating is what I’d call cross pollination between your own readers and the others in the competition.  This years contestants did a good job of promoting each other to their Twitter followers, readers and the community.  It is win-win for everyone.

3) Learning Opportunities – I personally enjoy learning and getting exposed to new tech ideas and products.  Its what gets me up in the morning.  So, getting to see new things is exciting to me.  Knowledge is something no one else can take away…  Even though it was a competition, the other contestant shared freely with the group.

I urge any bloggers to jump at the chance to participate in this contest in the future.  It is great for personal growth and for learning. I can’t wait to see what Thomas and the sponsors have in store for 2012.

BRC2K11 Community TV Interviews

Watch live streaming video from vmwarecommunitytv at livestream.com
2 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
General

Neglect…

by Philip Sellers
written by Philip Sellers

Well, its a new quarter and I feel a big obligation to post something to the blog.  I cannot believe it has been three months since my last post.  I have several irons in the fire, but on the work front, I am glad to report that the vSphere upgrade has been completed and we are performing the final stages of upgrading all our VMware tools, drivers and virtual hardware.  This has been a several month long transition and I have several draft posts waiting to go out which were started as things came up during the upgrade.  This project has kept me extremely busy, much to the detriment of the blog.  But the project has also provided a lot of good information which I want to pass along.

On a personal note, my wife and I are in the final stages of planning our new home, which we hope to begin building in the coming months.  Any free time that I would have had to blog about my experiences has been consumed with house plans, builder meetings and other items to prepare for this major undertaking.  My wife is attempting to chronicle our build on her blog, My Green Glasses.  The house will be a certified green home, Energy Star certified and *possibly* LEED certified.  We know that we will be close to meeting requirements for a LEED certification and we are looking at what additional things need to be done to make it happen and whether it is worth it or not.

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
General

Extreme Makeover: Home Edition returning to my area

by Philip Sellers
written by Philip Sellers

Extreme Makeover: Home Edition will be returning to my area – the Myrtle Beach area – to build a second home for a deserving family.  The local builder has setup a website where you can see the needs for the build as well as other information about the family, location, etc. after ‘door knock’ next Monday.  The build is set to begin on Jan 11 and reveal on Sunday, Jan 17.  Check out http://www.extremehorry.com for more information and to volunteer, if you’re local.

In addition to the build, the organizers have started a canned food drive with the hopes of collecting 10 tons of food – yes, literal TONS of food.  Given the state of the economy and the fact that food pantries are in need of food to distribute to families in the area, its great to see the builder using this opportunity to raise awareness and help the entire community, in addition to a family.

There is also a pep rally this morning at Coastal Carolina’s Wall Auditorium to kick off the project.

0 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
General

Anniversary passed without notice

by Philip Sellers
written by Philip Sellers

Yesterday marked a milestone for me.  I signed on with this blog exactly one year ago yesterday, and I missed my anniversary.  It was only today that I noticed that my archives extended back to August 2008 and when I clicked in, found that my first post went live on August 4.

I still seem to be finding my voice – finding my topic – and I guess that’s part of the journey.  I have always enjoyed writing, though I’m not sure my prose is particularly interesting to read, its something I will continue to try and refine.  My first year has been marked with posts about the work I’m currently doing and new projects I’m undertaking.   I started with a focus on two core topics – VMware and Apple stuff – and I’ve kinda stuck to those.  I expanded with my personal experiences with Mac finance software and some other topics, but early on, I got a lot of hits from my VMworld posts.  I hope to do this again this year at the conference.

Anyways, bear with me as I continue to figure out how to effectively do this – as I found out what people find useful or interesting – and as I continue to share my experiences from a sys admin’s world.

3 comments
0 FacebookTwitterPinterestLinkedinRedditEmail
@2019 - All Right Reserved. Designed and Developed by PenciDesign