Online Installation

Prepare your host system /VM

Before installation, make sure that your target system meets the technical requirements. A person with basic Linux skills must do the installation.

Warning

This page only applies to product installation with a stable internet connection!

Installation

Step #1 - Download and unpack the product installer:

Download the release archive from https://my.opswat.com/portal/products. Save it to a convenient location, for example your home folder.

The release archive is password protected. Use 7-Zip to unpack it:

Use the password that you received from OPSWAT support!

Adjust the x.y.z version numbers to match the downloaded filename.

7za x -aoa -p"PASSWORD" MetaDefender_NDR_vx.y.z-Standalone.zip

Step #2 - Move to the installation folder:

cd ndr-installer

Step #3 - Run the install shell script

This operation can take up to 20-30 minutes. The time depends on available network bandwidth.

sudo ./install.sh

The first installation step is EULA acceptance. Type ACCEPT to start the installation.

Step #4 - Access the NDR web server

Go to (https://localhost:443). Set up the initial Admin user.

username: admin

password: admin123

Step #5 - Add your activation key

Use the Activation Key that you received from your OPSWAT Sales Representative. Follow the instructions on the License Activation page.

Simple steps for Online activation:

Go to Admin panel > Settings > Integrations > License Management. Click Activate All. Then enter your license key!

Manager/sensor installation and adoption (v5)

MetaDefender NDR v5 deploys from a bootable ISO that runs a First-Boot Guided Installer. The installer supports three deployment roles. You can deploy a Manager and one or more Sensors independently.

Prerequisites

| --- | --- | --- | --- |

| Disk | 150 GB | 150 GB | 50 GB |

For Sensor enrollment to a remote Manager: HTTPS port 8443 must be open from sensor to Manager IP.

Obtain and boot the ISO

Download the NDR v5 ISO from the OPSWAT Customer Portal or your designated artifact repository.
Flash to USB. On Linux/macOS, use dd. On Windows, use Rufus in DD Image mode.
As an alternative, attach the ISO as a virtual CD-ROM in your hypervisor.
Boot the target server/VM from the ISO.
When the NDR boot menu appears, select Install NDR Platform.
Press Enter.
Wait until the automated Oracle Linux 9 OS installation completes (~10–20 minutes).
Let the system reboot automatically.

First-boot guided installer

After reboot, the NDR First-Boot Guided Installer starts automatically on the console. If you connect over SSH before setup completes, run:

sudo ndr-firstboot

Step 1: Accept the EULA. Enter ACCEPT.

Step 2: Select a deployment role:

1) All-in-One — Full NDR management platform with a local Suricata sensor on this host
2) Manager — Management platform only; you enroll sensors separately
3) Sensor — Network capture sensor that connects to an existing Manager

All-in-One role prompts

| Prompt | Example | Notes |

| --- | --- | --- |

| Management interface | eth0 | Interface for operator UI/API access |

| Capture interface(s) | eth1,eth2 | Comma-separated interfaces |

| HOME_NET | 192.168.0.0/16 | Internal network CIDR(s) |

| Sensor name | aio-sensor-01 | Friendly display name in the UI |

Manager only role

The installer prompts only for the management network interface. Use the NDR Web UI after installation for all further configuration.

Sensor only role — enrollment prompts

| Prompt | Example | Notes |

| --- | --- | --- |

| Manager URL | https://192.168.1.10:8443 | Manager enrollment API endpoint |

| Enrollment token | eyJ... | Generated from Manager UI |

| Capture interface(s) | eth1 | Interface(s) for traffic capture |

| HOME_NET | 192.168.0.0/16 | Internal network CIDR(s) |

| Sensor name | sensor-datacenter-01 | Friendly display name |

Generate a sensor enrollment token

Before you enroll a new sensor, generate an enrollment token from the Manager:

Log in to the Manager Web UI.
Go to Admin panel → Sensors → Add Sensor.
Copy the generated enrollment token (eyJ...).
When prompted, supply this token to the Sensor First-Boot Installer.

The sensor establishes a mutual TLS-authenticated channel to the Manager after successful enrollment. It appears in the Sensors list as Online.

Post-installation access

| Service | URL / Endpoint |

| --- | --- |

| NDR Web UI | https://<ip>:443 |

| SSH | ssh admin@<ip> |

| Sensor status | sudo systemctl status ndr-adapter.service ndr-sensord.service |

Airgapped deployments

The NDR ISO is fully self-contained. All container images are pre-loaded. The installation and normal operation require no internet access. For DNS-restricted environments, configure /etc/hosts or a local DNS resolver. This lets the system resolve the management hostname before sensor enrollment.

OVA installation for MetaDefender NDR v5

MetaDefender NDR v5 installs from a bootable ISO image. No pre-built OVA is available for import. This section tells you how to create and configure a virtual machine. It also tells you how to attach the NDR v5 ISO and run the First-Boot Guided Installer in a hypervisor.

OPSWAT distributes MetaDefender NDR v5 as a bootable ISO (not a pre-packaged OVA/OVF). Create the VM yourself with the specs below. Then install from the ISO exactly as you would on bare metal.

VM-based deployments support 1 Gbps sensors and below only. Higher throughput tiers (10 Gb, 20 Gb, 40 Gb, 100 Gb) require dedicated bare-metal appliances with hardware-level tuning (SR-IOV, pinned CPUs, hugepages, RAID NVMe). Do not run a high-throughput sensor in a VM.

Enable CPU virtualization extensions (Intel VT-x / AMD-V) in BIOS/UEFI. For nested virtualization (VM-inside-VM), make sure that the hypervisor exposes these extensions to the guest.

Supported hypervisors

| Hypervisor | Recommended Adapter | Notes |

| --- | --- | --- |

| VMware ESXi 7.0+ | VMXNET3 | Recommended for production |

| VMware Workstation / Fusion (Intel) | VMXNET3 or E1000e | Lab/demo use |

| KVM / Proxmox VE | VirtIO | Best open-source option |

| VirtualBox | Paravirtualized / Intel PRO/1000 | Lab use only |

VMware Fusion on Apple Silicon (ARM/M-series) is not supported. MetaDefender NDR v5 requires x86_64 architecture.

VM size requirements

Sensor virtual machine (1 Gbps)

| Resource | Minimum | Recommended |

| --- | --- | --- |

| vCPU | 24 cores | 32 cores |

| RAM | 256 GB | 256 GB |

| Storage | 7.68 TB | 7.68 TB NVMe |

| Management NIC | 1 GbE | 1 GbE (static IP) |

| Capture NIC(s) | 1 GbE+ | 1+ dedicated capture interfaces |

Configure capture NIC(s) in promiscuous mode so the VM can see all traffic on the monitored segment. In VMware, set the vSwitch/portgroup to Promiscuous Mode: Accept. In Proxmox/KVM, set the bridge up without ARP filter.

Manager VM

| --- | --- | --- | --- | --- |

Elasticsearch and ClickHouse use Manager storage for event retention. 19.2 TB (Manager STD) supports approximately 90 days of full event retention at typical enterprise traffic volumes. Add storage or nodes if you need longer retention.

Attach the ISO

VMware ESXi / vCenter:

Upload the NDR v5 ISO to your datastore.
Edit VM Settings → CD/DVD Drive → Datastore ISO File → select the ISO.
Select Connect at Power On.

VMware Workstation / Fusion:

VM Settings → CD/DVD → Use ISO Image File → browse to the NDR v5 ISO.

Proxmox VE:

Upload the ISO to local (pve) → ISO Images.
VM → Hardware → Add → CD/DVD Drive → select the ISO from storage.
Set the boot order to boot from the CD drive first.

KVM / virt-manager:

Add Hardware → Storage → Select custom storage → ISO file.
Set boot device to CD-ROM in the Boot Options tab.

Install from the ISO

Power on the VM.
When the NDR boot menu appears, select Install NDR Platform.
Press Enter.
To install with FIPS 140-2 cryptographic enforcement (required for US federal or regulated environments), select Install NDR Platform (FIPS Mode) instead.
You cannot enable FIPS mode after installation — you must re-image to switch.
Wait until the automated Oracle Linux 9 OS installation completes (~10–20 minutes).
Let the VM reboot automatically.
After reboot, use the NDR First-Boot Guided Installer on the console (tty1).
Follow the prompts from the Manager/Sensor Installation and Adoption (v5) section above to complete your deployment.

Post-install: detach the ISO

After installation, detach the ISO from the VM's CD/DVD drive. This prevents boot from it on the next restart.

After a successful install, the VM boots directly from disk and the ISO is no longer needed. It is harmless but unnecessary to leave the ISO attached.

Last updated on

Was this page helpful?