Technical requirements to the Cyberwatch installation

The installation of Cyberwatch consists of installing the software within your network on a virtual machine that has been previously configured and dedicated for this purpose.

The configuration of the virtual machine must comply with the hardening level recommended in your information system security policy. The official Docker documentation and the page Deploy Cyberwatch with Swarm on a hardened system describe the necessary limitations for the software to function properly.

This operation is carried out by Cyberwatch engineers and lasts half a day.

The prerequisites for the installation intervention are:

Configuration of the virtual machine that shall receive the Cyberwatch software

Installation on a Swarm node

Operating system

Linux 64-bit machine with a minimum Kernel 5.11.
Operating system of your choice among:
- Debian 13
- Ubuntu 24.04 or 26.04
- Red Hat 9
- Rocky Linux 9
- AlmaLinux 9
- Oracle Linux 9
The machine must have access to the official repository of the distribution or equivalent and be up to date
Up-to-date machine (apt upgrade / yum update)

Hardware requirements (recommended)

4 vCPU
RAM 16 GB

The minimum requirements are 2 vCPU and 12 GB RAM.

Disk space requirements

It is recommended to allocate the entire disk space to the root partition /. The breakdown below is provided for informational purposes.

Hard drive 80 GB:
- 5 GB on /var/lib/cyberwatch/
- 60 GB for container images, running containers, and data in /var/lib/docker (25 GB) and /var/lib/containerd (35 GB)
- 15 GB for the system

Installation on a Kubernetes node

Dedicated Cyberwatch hardware requirements

2 vCPU
RAM 12 GB

Technical prerequisites for cluster configuration

The following list constitutes the prerequisites for deploying and ensuring the proper functioning of Cyberwatch on a Kubernetes cluster.

Have a functional DNS entry to access the Cyberwatch application. This DNS entry must point to the IP address of the Kubernetes cluster load balancer, or the ingress controller. This record is mandatory; access to the application via the IP address is not possible.
Have an environment where the Helm (version > 3.8.0) and Kubectl programs are installed and configured to access the Kubernetes cluster.
The Kubernetes cluster must have:
- a DNS resolver such as core-dns
- a functional ingress-controller, the OVH documentation provides an example of how to set one up
- a storage system capable of dynamically generating PersistentVolumes via a StorageClass
To check that the cluster has a DNS resolver:
```
kubectl cluster-info
```
The nodes running the container-scanner pod must allow the creation of unprivileged user namespaces. The analysis of container images relies on Buildah in rootless mode, which uses user namespaces to extract the analyzed images.
The sysctl parameter user.max_user_namespaces must have a strictly positive value. The kernel’s default value, calculated based on available memory, is suitable. To check the configured value on a node:
```
sysctl user.max_user_namespaces
```
Some hardened distributions disable user namespaces (user.max_user_namespaces = 0). In this case, image analysis fails with errors such as Error during unshare(CLONE_NEWUSER): No space left on device or potentially insufficient UIDs or GIDs available in user namespace. In this case, re-enable user namespaces by following the distribution’s documentation.

Installation on a Podman node

Operating system

Linux 64-bit machine with a minimum Kernel 5.11.
Operating system of your choice among:
- Debian 13
- Ubuntu 24.04 or 26.04
- Red Hat 9
- Rocky Linux 9
- AlmaLinux 9
The machine must have access to the official repository of the distribution or equivalent and be up to date
Up-to-date machine (apt upgrade / yum update)

Hardware requirements (recommended)

4 vCPU
RAM 16 GB

The minimum requirements are 2 vCPU and 12 GB RAM.

Disk space requirements

Hard drive 60 GB:
- 5 GB on /var/lib/cyberwatch/
- 40 GB for container images, running containers, and data in /home/cyberwatch
- 15 GB for the system

Network requirements

For Cyberwatch to function properly, outgoing HTTPS flows must be allowed to:

For Kubernetes and Podman, the flow to download.docker.com is not required.

dl.cyberwatch.com
download.docker.com
harbor.cyberwatch.fr
securitydb.cyberwatch.com
download.windowsupdate.com (optional)

Associated flows matrix:

Source	Destination	Protocol	Port	Description
Cyberwatch server	`download.docker.com`	TCP	443	Docker installation and updates
Cyberwatch server	`harbor.cyberwatch.fr`	TCP	443	Cyberwatch Docker images registry
Cyberwatch server	`securitydb.cyberwatch.com`	TCP	443	Synchronization with the vulnerabilities database
Cyberwatch server	`download.windowsupdate.com`	TCP	80	Downloading the .cab for Microsoft Update
Cyberwatch server	`dl.cyberwatch.com`	TCP	443	Alternative to download the .cab for Microsoft Update, and Cyberwatch package repository

Cyberwatch web interface usage prerequisites

Cyberwatch recommends using an up-to-date browser. We support all browsers that are not end-of-life.

All requests sent to the Cyberwatch web interface are handled over HTTPS, and by default use a self-signed certificate generated during installation. For security reasons, we recommend referring to our procedure to change the Cyberwatch TLS certificate to modify it once the installation is complete.

Configuration of the assets to be audited by Cyberwatch

Before deployment, you can prepare the prerequisites for supervising assets, using agent-based or agentless modes, depending on the chosen methods.

Configuration of the assets to be audited by Cyberwatch with the “agent-based” mode

See the documentation on prerequisites for assets to be audited in agent-based mode.

Additional details are available in the technical help to prepare assets for an agent-based deployment.

Configuration of the assets to be audited by Cyberwatch with the “agentless” mode

See the documentation on prerequisites for assets to be audited over agentless connections.

If needed, Cyberwatch also provides technical help to prepare assets for an agentless connection.

Planning the half-day workshop to deploy Cyberwatch

Contact us at support@cyberwatch.com or call us at +33 1 85 08 69 79 to set an intervention date
Cyberwatch engineers will carry out the operation during the agreed time slot, via remote access (TeamViewer, WebEx…) or SSH access to the Cyberwatch central machine