Adjusting Security Intelligence NTA Event Retention

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

NTA events are generated by detectors stored in postgres by nta-server. By default, these events are retained for 30 days after which they're deleted. On some customer environments, it may be desired to adjust this retention period.

In order to adjust the retention period, the nta-server configmap can be used to set a retention in days. 

Environment

SSP 5.0

Cause

NTA events are stored for 30 days past their last detection time. In environments which generate many NTA events, there may be a desire to reduce the retention to reduce storage consumption

Resolution

Configuring Retention

Step 1: Access SSPI as root

Step 2: Edit the nta-server configmap, add or adjust the config nta.event.maxEventRetentionDays

k -n nsxi-platform edit configmap nta-server-app   # insert or add data:   nta:  # already exists, if not add     event:  # already exists, if not add         maxEventRetentionDays: 7 <------------------- add this field

Step 3: Restart the nta-server pod

k -n nsxi-platform rollout restart deployment/nta-server

The job is run in the nta-server pod and is triggered once daily at 3:00. The spring schedule string is "0 0 3 ? * * *".

The older events will still be in the system and visible until the job is run.

There is no way to adjust the schedule or trigger the job manually at this time. If events need to be purged immediately, follow the below steps.

Purging Old Events Immediately

Step 1: Access SSPI as root

Step 2: Navigate to the PG SQL Prompt

k -n nsxi-platform get pods | grep postgres # look for "postgresql-ha-postgresql-0" pod   k -n nsxi-platform exec -it <postgres pod> -- bash   # in the pg pod env | grep POSTGRES_PASSWORD psql pace # enter pg password from above when prompted

 

Step 3: Issue SQL query

delete from nta.event where last_detected_time < <epoch_timestamp in milli seconds>;

The output should be the number of rows deleted.