Installation

Minimum system requirements

Server minimum system requirements

CYBERQUEST is a virtual appliance but can be installed as a physical appliance as well.

In order to install CYBERQUEST 2.30 physical or virtual machines must be provided. CYBERQUEST 2.30 resides on a Linux Debian 11 instance.

• For all CYBERQUEST residing virtual machines resources must be reserved (CPU cores and RAM).

• For CYBERQUEST best performance 6th gen Intel CPU’s or equivalent must be provided.

Minimum recommended resources, as per the standard versions (no add-ons installed and for CYBERQUEST 2.30 Ultimate - 8 CPU cores license) are:

Version of CYBERQUEST 2.20	Minimum RAM recommended	Minimum Storage Recommended - GB (for data only)
Logger	8*	100**
Light	8*	200**
Advanced	16*	500**
Enterprise	32*	1000**
Ultimate	32*	1000**

*This is the minimum recommended RAM to be granted to virtual machines hosting CYBERQUEST instances. As the solutions may scale, higher RAM capacity must be allocated. For such situations, a certified CYBERQUEST technician must be consulted.

**This is the minimum recommended storage capacity - for data only. The retention period (data availability for hot searches and archive) is directly proportional with the storage capacity. For situations where online and offline data must cover longer periods, a certified CYBERQUEST technician must be consulted in order to provide requirements for storage capacity.

User(client) web application minimum system requirements:

• Web Browsers: Firefox (86+), Chrome (83+)

• Resolution: Full HD Display (1980x1080)

Windows collector (agent)

• .Net Framework 4.8

• Windows Server operating System (2012+) x64 operating system

• Visual C++ redistributable 2019+

Supported virtual enviroments

VMware is a virtualization computing software. With VMware server virtualization, a hypervisor is installed on the physical server to allow for multiple virtual machines (VMs) to run on the same physical server. Each VM can run its own operating system (OS), which means multiple operating systems can run on one physical server. All the VMs on the same physical server share resources, such as networking and RAM.

Hyper-V is Microsoft's hardware virtualization product, each virtual machine runs on virtual hardware. Hyper-V runs each virtual machine in its own isolated space, which means you can run more than one virtual machine on the same hardware at the same time. Hyper-V allows you to create virtual hard drives, virtual switches and a host of other virtual devices, all of which can be added to virtual machines.

AIO

Installation for VMware

Prior installation system requirements

In order to configure the virtual machine, the following requirements must be met first:

• ESXi 8.0 or later;
• 4 CPU cores;

• Minimum 32 GB RAM (64 GB recommended);

• Minimum 60 GB Storage;

Download the CYBERQUEST server by registering on the portal here, navigating to the Downloads section, selecting Cyberquest for VMware, agreeing to the license terms, and clicking the Download button.

Installing CYBERQUEST

A. OVA Deployment

For deploying the CYBERQUEST virtual machine (OVA file), follow these steps:

1.Connect to vCenter (or ESXi Hypervisor). Open vSphere Client or the web interface. Fill in the username and password credentials.

2.Right click on Virtual Machines and select Create/Register VM

3.In this window, select Deploy a virtual machine from an OVF or OVA file and click on Next

4.Name the virtual machine (e.g., CYBERQUEST), and click on Click to select files or drag/drop to select files for CYBERQUEST server deployment.

5.In the new window, locate the CYBERQUEST virtual machine, select the files and click Open > Next.

6.Select the storage location for importing the virtual machine, then click Next.

7.Select the network and check the box for Thin in Disk provisioning, then click Next.

8.Review the previously selected parameters, click Finish and wait for the import of CYBERQUEST virtual machine to be complete.

B. CYBERQUEST virtual machine configuration

1.Start the CYBERQUEST virtual machine using the vSphere client (or the web interface) by selecting the Power on button in the top menu.

2.To open the console, right-click the virtual machine, then select Console > Launch Remote Console. The Console button in the menu can also be used.

3.Connect using the username “superadmin” and password “toor1”.

4.To set the TimeZone, use the following command and follow the interactive steps:

tzselect

5.Configure the network by running the command and setting the Static IP:

sudo nano /etc/netplan/def.yaml

To apply the network configurations run this command:

sudo netplan apply

6.The services start automatically. If they fail to start, log in as root, navigate to the cyberquest-deployment directory, and run the following command:

systemctl start cyberquest-deployment.service

Check that the services have started by running the following command:

docker ps -a

Installation for Hyper-V

Prior installation system requirements

In order to configure the virtual machine, the following requirements must be met first:

• HyperV (minimum Windows 2016);
• VM Gen 1 compatible;
• 4 CPU cores;
• Minimum 32 GB RAM (64 GB recommended);
• Minimum 60 GB Storage;

Deployment Guide for Hyper-V

To deploy the CYBERQUEST server in a Hyper-V environment do the following steps:

Step 1: Download the CYBERQUEST server from here. Register and click on Downloads section and after select Cyberquest for Hyper-V, and press Download button.

Step 2: Extract the content of the archive

Step 3: Open Hyper-V Manager from Start > Windows Administrative Tools

CYBERQUEST server can be deployed by create a virtual machine and attach the 3 virtual disks.

Create a virtual machine and attach the CYBERQUEST virtual disks

A. To create CYBERQUEST virtual machine please follow the steps from bellow:

1.In the top-left corner, right-click the Hyper-V server and select: New > Virtual Machine.

2.In the Before You Begin section, click Next.

3.In the Specify Name and Location section, provide a name for the CYBERQUEST server and choose the folder to store the virtual machine.

4.In the Specify Generation section, select the appropriate Generation type for the environment and click Next.

5.In the Assign Memory section, enter the RAM amount for the CYBERQUEST server and click Next.

6.In the Configure Networking section, choose the network switch and click Next

7.In the Connect Virtual Hard Disk section, select Attach a virtual hard disk later and click Next

8.In the Summary section, click Finish

B. To attach the CYBERQUEST virtual disks, follow the steps below:

1.Right-click the created Virtual Machine and select Settings.

2.In the Settings window select IDE Controller 0. In the right side select Hard Drive option and click Add

3.In the Media section, click Browse and navigate to the location where the CYBERQUEST server virtual hard disks are stored.

4.Select the first disk file cqos-main.vhdx, and after click Open and Apply

5.In the Settings window select IDE Controller 0. In the right side select Hard Drive option and click Add

6.In the Media section, click Browse and navigate to the location where the CYBERQUEST server virtual hard disks are stored.

7.Select the second disk file cqos-docker.vhdx, and after click Open and Apply

8.In the Settings window select IDE Controller 1. In the right side select Hard Drive option and click Add

9.In the Media section, click Browse and navigate to the location where the CYBERQUEST server virtual hard disks are stored.

10.Select the last disk file cqos-data.vhdx, and after click Open and Apply

11.Click OK to complete adding the CYBERQUEST Virtual Hard Disks.

12.To set the TimeZone, use the following command and follow the interactive steps:

tzselect

13.The services start automatically. If they fail to start, log in as root, navigate to the cyberquest-deployment directory, and run the following command:

systemctl start cyberquest-deployment.service

To verify that the services have started, run the command:

docker ps -a

Agent Installation

Windows Agent

Manual deployment

How to manually deploy agent for Windows based collections

To install the CYBERQUEST agent on the Windows target machine, the following prerequisits must be met:

1. Install vcredist_x64_2010.exe
2. Install vcredist_x64_2012.exe
3. Install vc_redist_x64_2019.exe
4. Install Microsoft .NET Framework 4.8

Authentication

To access Web Interface, open a web browser and type the application's address or DNS name. The default address initially assigned to Web Interface is https://CyberquestIPAddress (example).

The browser automatically redirects you to CYBERQUEST's authentication page:

How to manage Credentials

Creating the credentials set the agent is using for collecting data.

Please follow the link for more details.

Installing the CYBERQUEST agent

To manually deploy the agent, download or copy the agent kit on the target machine.

Navigate to Settings > Management > Agent Manager.

"Download windows agent" to download the latest version of the CYBERQUEST agent. The agent must be installed on a Windows machine.

Execute the .msi file and press the "Run anyway" button to install the agent. The agent is installed in: "C: \ Program Files \ CyberQuestAgent".

Go to "C:\Program Files\CyberQuestAgent\configurator" and run cyberquest-agent-configurator.exe as an Administrator. Add the IP address of the CYBERQUEST server in the field "Message Queue server" and press the "Save Settings" button.

Go to Windows services and restart the CYBERQUEST agent service.

Registering the agent

Registering the agent in the CYBERQUEST server:

Navigate to "Settings > Management > Agent Manager".

Press button to register the agent.

Complete the following fields: "Agent name", "Agent note", assign credentials for the agent and press "Save" button.

After deployment you have to press the button, to set the agent as manually deployed.

Adding a new data sources

The Windows agent is used to connect and collect Windows based data-sources like :

• WMI (Windows Management Instrumentation)

  • Windows Security Log

  • Windows Application Log

  • Windows System Log

  • Active Directory Information

• CQ Threat Intelligence

• ODBC Data Sources

• Oracle based DataSources

• MySQL (MariaDB) based DataSources

• API based data sources

• Text Files (freeText and CSV)

GPO deployment

Deploy CYEBERQUEST agent from GPO

To deploy CYBERQUEST Agent from GPO, please follow the steps described bellow:

1.Create a share accessible from all clients where the AgentCQ will be Deployed.

2.Copy the the following files:

3.Edit file Copy config.ps1

Copy-Item -Path \\FS_server\CQDeployShare\agent.settings.json -Destination "C:\Program Files\CyberQuestAgent"
Stop-Service -Name CyberQuestAgent
Start-Sleep -s 30
Start-Service -Name CyberQuestAgent

The path for the copyed files in step 2 is: \FS_server\CQDeployShare\

4.Edit agent.settings.json file

{
"mqPassword": "VRW7Zl7RreWg9Q==",
"eventSyncQueueSize": 5000,
"compressData": false,
"encryptData": false,
"cleanupOlderLogsDays": 7,
"throttleCollection": 1000000,
"mqHost": "0.0.0.0", //CYBERQUEST Server IP Address
"mqUserName": "cq",
"mqUseSSL": false,
"useHTTPSTransport": false,
"rejectUnauthorized": false,
"EventsThrottleQueueMaxSize": 100000,
"mqPort": 5672,
"mqSSLPort": 5671,
"tenant": "danielt-pc",
"HttpTransportUrl": "",
"CLIENT_ACCESS_TOKEN": ""
}

5.Go to Domain Controller and open Group Policy Management

6.Right click on the Organization Unit where the Policy will be applied (Ex: “Computers” OU) and select Create a GPO in this domain, and Link it here.

7.Name the new GPO CQ Deploy GPO and click OK button

8.Right click on the new created GPO and select Edit option

9.Navigate to Computer Configuration > Policies > Software Settings > Software Installation

10.Right click on Software Installation and select New > Package…

11.Browse to the share location created in step 1 and configured in step 3 (\FS_server\CQDeployShare), select the MSI file and click Open button

12.Select Assigned option and click OK button

13.Navigate to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown), right click on Startup and select Proprieties

14.Go to PowerShell Scripts tab and press on Show Files… button

15.In the new File Explorer window copy the PowerShell script file (Copy config.ps1) from the shared folder created on step 1

16.Click on Add… button, click on Browse button, select the PowerShell Script Copy config.ps1 and click Open and then OK > Apply > OK

17.Close Group Policy Management Editor, right click on the new GPO and select Enforced option

Remote installation

To install the CYBERQUEST agent on the Windows target machine, the following prerequisits must be met:

1. Install vcredist_x64_2010.exe
2. Install vcredist_x64_2012.exe
3. Install vc_redist_x64_2019.exe
4. Install Microsoft .NET Framework 4.8

To start, first configure the deploy credentials. Please follow the link for more details about creating credentials.

**Deploying CYBERQUEST agent on Windows **

The next step is to deploy the CYBERQUEST agent on Windows operating system, by clicking on Settings > Management > Agent Manager, and click on button.

To register a new agent, the user will first be asked the operating system on which to deploy the agent, with the option of Windows.

Once selected, the settings of the agent deployment will be filled in. Complete the following fields: ”Agent name”, “Computer“, select “Agent deployment credentials“ and press "Save" button.

Lastly, data sources can be linked to the CYBERQUEST agent.

The Windows agent is used to connect and collect Windows based data-sources like :

• WMI (Windows Management Instrumentation)

  • Windows Security Log

  • Windows Application Log

  • Windows System Log

  • Active Directory Information

• CQ Threat Intelligence

• ODBC Data Sources

• Oracle based DataSources

• MySQL (MariaDB) based DataSources

• API based data sources

• Text Files (freeText and CSV)

Managing Windows Gathering Agent

Manage CYBERQUEST Log Gathering configuration files

For more details about manually deploy Agent and assign data sources, please access the following link: How to manually deploy agent and assign data sources

Please note that in order to successfully change entries in configuration files, the agent service must be in stopped state:

a. Using an administrative account, authenticate to the Windows log gathering computer having the agent installed and open Services management console

b. Stop CYBERQUEST Log Gathering Agent service.

c. After finished performing changes, start CYBERQUEST Log Gathering Agent service.

To see how to manually deploy the agent, please follow the link: How to manually deploy the agent

CYBERQUEST One-Click Installation for other Operating Systems

One-Click Install has been tested and validated on the following operating systems:

• Debian 12

• Debian 13

• RedHat 9.4

• RedHat 9.6

• RedHat 10.0

• Ubuntu 22.04

• Ubuntu 24.04 LTS

The following prerequisites are required on all supported operating systems before starting the deployment:

• sudo (user must be in the sudoers list) and root privileges
• curl
• Docker

Prior installation system requirements

In order to configure the virtual machine, the following requirements must be met first:

• Three partitions:

• minimum 34 GB (where the Operating System will be installed)

• minimum 32 GB (where the Docker containers are stored)
• minimum 10 GB (where the data will be stored)

If these partitions contain any data, the existing data will be deleted during the installation process.

• An internet connection is required;

• 4 CPU cores;

• Minimum 32 GB RAM.

CYBERQUEST Deployment on Ubuntu 24.04 VMs

Implementing a CYBERQUEST virtual environment requires precise configuration to ensure proper operation and consistency across systems. This guide provides a simplified approach to configuring CYBERQUEST on virtual machines, reducing setup time and minimizing potential configuration errors.

The steps in this guide apply to all supported operating systems. Only on Red Hat-based systems are additional commands required.

The steps below detail the deployment of CYBERQUEST on Ubuntu 24.04, including environment setup and configuration:

Step 1: Run the following command as root to start the CYBERQUEST deployment.

mkdir cyberquest-deployment && cd cyberquest-deployment &&  curl -O https://download.cyberquest.cloud/install_sfx.sh  && sudo bash ./install_sfx.sh

Step 2: After executing the installation script, a prompt will appear asking "Do you want to proceed with the application installation?". Select y and press ENTER to move forward with the deployment.

Step 3: Once Docker is installed, the script will check for available disks to create a partition for /data. A list of clean disks will be displayed. Select a disk (e.g., sdb or sdc and press ENTER) to create the new partition.

Step 4: The deployment script mounts the /data partition and updates /etc/fstab to ensure it is automatically mounted on boot. It then scans for available disks to create a partition for /docker. Choose a disk from the list to allocate space for Docker storage and continue the deployment.

Step 5: After the preparation script completes, the TLS configuration is initialized. By default, only TLS 1.3 is enabled.

note that TLS 1.3 requires Windows 11 or newer, or Windows Server 2019 or newer for the agent collector.

When prompted, choose whether to also enable TLS 1.2 by typing y for yes or n for no.

Step 6: Set the timezone for CYBERQUEST by selecting the appropriate region and city. This ensures that time-related settings in the application are configured correctly.

Step 7: Select the country that matches the local time. This helps CYBERQUEST apply the correct time settings for the environment.

Step 8: Review the timezone information that was set based on the previous selections. Confirm that the displayed local and universal times are correct by choosing Yes to proceed or No to make adjustments.

Step 9: Configure the Java heap size, which determines the amount of memory allocated to the Java Virtual Machine for CYBERQUEST. Enter the size in GB or press Enter to use the default value.

Step 10: In the cyberquest-deployment directory, run the following command to download the latest CYBERQUEST Docker images:

docker compose pull

⚠️ Attention - RedHat Only

For RedHat systems, the following commands must be executed before starting the CYBERQUEST services to allow HTTPS access through the firewall:

sudo firewall-cmd --zone=public --add-service=https --permanent
sudo firewall-cmd --reload

sudo firewall-cmd --reload

Step 11: Start the CYBERQUEST deployment service by running the following command:

docker compose up -d

Step 12: Check the status of the CYBERQUEST services to verify they are starting correctly by running:

docker ps -a

To log in to the CYBERQUEST application, enter the default username and password, then choose the desired interface language.

Default Username: superadmin

Default Password: toor1

You will be prompted with a default message about accessing restricted information. This message is fully customizable.

Accept the responsibility by clicking the button "Yes, I take full responsability!".Else "No. I disagree" and you will be redirected to the authentication page.

How to install Ubuntu 24.04 LTS on VMware

1.Download the Ubuntu 24.04 LTS ISO from the official Ubuntu site Ubuntu 24.04.

2.Open VMware Workstation/Player > Create/Register VM > Create a new virtual machine.

3.Choose guest OS type:

• Name: Ubuntu_24_04_LTS
• Compatibility: ESXi 8.0 U2 virtual machine
• Guest OS family: Linux
• Guest OS version: Ubutu Linux (64-bit)

4.Select storage: Select a datastore for the virtual machine's configuration files and all of its virtual disks.

5.Customize settings - configure the virtual machine hardware and additional options.

Configure "CPU" and "Memory" according to your needs.

• The recommendation is a minimum of 4 cores.

• The recommendation for the Memory is a minimum 32048 MiB.

Configure three disk partitions. To add more disk partitions click on Add hard disk and choose New standard hard disk.

• Hard disk 1 - 10 GB (where the Operating System will be installed)

• New Hard disk - 32 GB (where the Docker containers are stored)

• New Hard disk - 10 GB (where the data will be stored)

Configure "Network" settings.

Go to CD/DVD Drive 1 choosing Datastore ISO file and select the ubuntu-24.04.3-desktop-amd64.iso.

6.Review and confirm the settings.

Ubuntu 24.04 Installation

1.Boot the VM

Start the virtual machine in VMware to begin the Ubuntu installation process. Ensure the Ubuntu ISO is mounted so the VM can boot from it.

The VM will boot from the ISO file ubuntu-24.04.3-desktop-amd64.iso. When the boot menu appears, select Install Ubuntu to begin the installation process.

2.Select Language and Keyboard

Choose the preferred language for the system interface and the desired keyboard layout for input.

3.Connect to the internet

Ensure the VM is connected to a network. Select the available Wi-Fi or wired connection to enable downloading updates and third-party software during installation.

4.Updates available

Choose whether to install updates during installation to ensure the system is up to date with the latest security patches, bug fixes, and feature improvements. Alternatively, select Skip to update after the installation is complete.

5.Installation type

Install Ubuntu alongside the current operating system allows Ubuntu to coexist with an existing OS, preserving its files and settings.

6.Ubuntu Installation Method

Select the installation approach:

• Interactive Installation - Guides the user step by step through configuration options including partitions, user accounts, and software selection.
• Automated Installation - Uses predefined settings to install Ubuntu with minimal user input.

7.Application Selection

Choose between Default Selection or Extended Selection for pre-installed applications:

• Default Selection - Installs only essential applications for a basic Ubuntu environment.
• Extended Selection - Installs additional software, including office suites, media players, and other utilities.

8.Install Recommended Proprietary Software

9.Installation Method

Choose how Ubuntu will be installed:

• Erase disk and install Ubuntu – Installs a fresh system by formatting the selected disk.
• Manual Installation ("Something else") – Allows custom partitioning, mount points, and disk selection.

10.Select Installation Location

Specify the disk or partition where Ubuntu will be installed, ensuring the system is placed on the desired storage device.

11.Create a User Account

Set up a user account by providing a full name, username, and password.

12.Select timezone

Choose the appropriate timezone for the system to ensure correct time and date settings.

13.Ready to Install - Review and Confirm

Review all installation settings, including disk partitions, user account, timezone, and software selections. Once confirmed, proceed to install Ubuntu on the system.

Once the installation is complete, a confirmation message is displayed. The system can now be restarted or testing can continue immediately, depending on the chosen action.