FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
Andy_G
Staff
Staff
Article Id 191205
Description
This technote provides you with the steps that you require to perform if you want to launch a CyOPs™ instance from Amazon Machine Images (AMI).
Solution

Prerequisites

You must provide CyberSponse Support with your AWS Account ID and the Region in which you will launch the AMI.
Based on these details, CyberSponse Support will share the CyOPs™ AMI with you.

Specifications

Recommended Specifications for your instance on AMI: T2.2xlarge

Minimum Specifications for your instance on AMI: T2.xlarge

Launching a CyOPs™ instance from AMI

To launch a new EC2 instance from an AMI do the following:

  1. Log into your AWS account and open the EC2 console.
    Note: Ensure to select the AWS Region in which you will launch the instance. The region must match with the region you have provided to CyberSponse Support.
  2. From the Navigation Bar, choose AMIs.
  3. Find the AMI you want to use to launch a new instance using the menu that is present next to the search bar and select Private images. The options in the menu are:
    Owned by me: If the AMI you are using is the one that you have created, then select Owned by me.
    Public images: If the AMI you are using is a public AMI, then select Public images.
    Private images: If the AMI you are using is a private image that someone else has shared with you, then select Private images.
    Note: The search bar automatically provides filtering options and matching AMI IDs.
  4. Select the AMI, and then choose Launch.
  5. Choose an instance type, and then choose Next: Configure Instance Details.
  6. Review the Instance Details, and then choose Review and Launch.
  7. Choose your preferred boot volume, choose Next, and then choose Launch.
  8. Select an existing key pair or create a new key pair, select the acknowledge agreement box, and then choose Launch Instances.
  9. Choose View Instances to check the status of your instance.

For more information on this topic, click here.


If users require to extend the existing HDD size or any partition of the existing instance, then users require to create a volume in AWS and extend the existing volume. The steps for the same are mentioned in the following sections:


Creating a volume in AWS

Following are steps on how you can create a volume in AWS, if required:

  1. Log into your AWS account and open the EC2 console.
  2. Click Volumes > Create Volume.

  3. In the Create Volume section, enter all the required details and click Create Volume.
  4. Once the volume has been created, on the Create Volume page, select the newly created the volume and from the Action menu, select the Attach Volume option.
  5. In the Instance textbox, specify the Instance ID, and click Attach.
    For more information on attaching an Amazon EBS Volume to an instance, click here.


Extending an existing volume

To extend an existing volume using newly created volume, run the following commands:

  1. Stop all the cyops services using the following command:
    # sh /opt/cyops/configs/scripts/services.sh stop
  2. Check the newly attached volume using the following command:
    # lblk
    This command displays all types of attached volumes.
    Check the volume type /dev/xvd<a/b> that is unpartitioned at the bottom of the output.
  3. Create the partition type using the following command:
    /dev/xvd<a/b>(volume_name)
    # pvcreate /dev/<volume_name>
  4. Check the volume group in which to add above partition. By default, volume group is created as cybersponse group.
    # vgs
  5. Extend the volume group using the following command:
    # vgextend <group_name>  /dev/<volume_name>
  6. Extend the logical volume using the following command:
    # lvextend -L+<size>G  /dev/<group_name>/<partition_name>
    /dev/<group_name>/<partition_name>: Specify partition name which need to extend
  7. Grow the partition size using the following command:
    # xfs_growfs  /dev/<group_name>/<partition_name>
  8. Check the partition size using the following command:
    # df -h

Contributors