Install and run NocLens

Version 0.9 · For administrators

Requirements

The server needs internet only for the install, updates and a daily license check. Offline servers are supported (see License).

Install

On the server, as a user with sudo:

sudo ./install.sh        # from the NocLens bundle we send you

The installer checks the server, installs Docker if needed, places NocLens in /opt/noclens, starts it and prints:

• the address to open, for example https://10.0.0.20/
• a one-time setup code

Running the installer again is safe; it never touches your data or settings.

First run

Open the address in a browser. The setup page asks for the setup code and creates the first administrator (password of 12 characters or more). Lost the code? Run sudo noclensctl setup-code.

Remove the certificate warning

NocLens encrypts every connection from the first start, using its own certificate authority. Browsers warn until they trust it. Pick one:

• Trust the NocLens authority once. Run sudo noclensctl ca-cert, copy the file to your PCs and import it under Trusted Root Certification Authorities (or push it with Group Policy).
• Use your own certificate. Put cert.pem and key.pem in /opt/noclens/data/certs/, set NOCLENS_TLS=/certs/cert.pem /certs/key.pem in /opt/noclens/.env and run sudo noclensctl restart.

License

Without a license NocLens runs the Free plan: Audit module, 25 devices. To activate a paid plan open System in the left menu, paste the key from your purchase email and press Activate. The license renews itself each month while your subscription is active.

If a payment fails you keep full access for 14 days. After that the server runs as the Free plan until the license is renewed. Nothing is deleted.

Your first audit

1. Press New audit in the left menu, give the network a name and one or more management ranges, for example 10.10.0.0/24. One request can cover up to 4,096 addresses.
2. Enter a read-only device account. Credentials are stored encrypted on the server; the key is /opt/noclens/secrets/credentials.key.
3. Press Start the first scan. NocLens finds the devices, logs in and audits them. Findings appear with the device's own output as evidence.
4. Open Plan for the priority list, and Report for the PDF.

NOC Wall (Pro and MSP)

Open /wall/ on your NocLens address (phone view: /wall/m). For a TV that should stay signed in, create a wall-screen link on the System page; it opens the wall only.

Site names and internet probe targets live in /opt/noclens/data/wall/site.json:

{
  "site_name": "Head Office · Network Operations",
  "site_short": "HQ",
  "isp_name": "Your ISP",
  "audit_client": "head-office",
  "anchors": [
    {"ip": "203.0.113.1", "label": "ISP gateway", "role": "gateway"},
    {"ip": "203.0.113.53", "label": "ISP DNS", "role": "isp"},
    {"ip": "1.1.1.1", "label": "Internet", "role": "internet"}
  ]
}

audit_client is the network name from the Audit module; its discovered switches are monitored automatically. For traffic charts, export NetFlow v5 from your firewall to the NocLens server on UDP 2055. For phone alerts, install the free ntfy app, pick a long random topic, and set NTFY_TOPIC in .env.

Connect your devices (logs)

The Wall and SOC tiles are fed by the built-in NocLens Collector. Point each device's syslog at the NocLens server, UDP or TCP port 514. Replace 10.0.0.20 with your NocLens server address.

Each tile shows BLIND until a device that can report it is sending logs, so silence is never mistaken for "all clear". Events are kept for 7 days (NOCLENS_RETAIN_DAYS). Routine allowed traffic is counted but not stored, except to ports that signal trouble (445, 139, 25).

Health tiles (CPU, temperature, fans, power) use SNMP v2c with the community from the Audit module. NocLens recognises the maker from the device's own ID and reads its tables; unknown makers use the standard HOST-RESOURCES and ENTITY-SENSOR MIBs.

SOC module with Wazuh (optional)

Already running Wazuh? The wall can read it instead of the built-in collector. Load the NocLens rules and decoders into your Wazuh manager, then connect the wall to the Wazuh indexer:

sudo cp /opt/noclens/soc-pack/rules/noclens_rules.xml /var/ossec/etc/rules/
sudo cp /opt/noclens/soc-pack/decoders/noclens_decoders.xml /var/ossec/etc/decoders/
sudo /var/ossec/bin/wazuh-analysisd -t && sudo systemctl restart wazuh-manager

The pack uses rule IDs 100200–110199. If your own custom rules use the same IDs, change them first; wazuh-analysisd -t reports any clash before the restart.

Copy root-ca.pem, admin.pem and admin-key.pem from your Wazuh install into /opt/noclens/data/soc-certs/, set NOCLENS_INDEXER_URL=https://<wazuh-ip>:9200 in .env and run sudo noclensctl restart.

Backups

NocLens backs up all its data every night at 02:30 to /var/backups/noclens and keeps 14 copies. To keep a second copy on a NAS, mount it and set NOCLENS_BACKUP_COPY_DIR in .env. Manual backup: sudo noclensctl backup. Restore: sudo noclensctl restore <file>.

Device passwords inside a backup are encrypted, and the key (/opt/noclens/secrets/credentials.key) is deliberately not in the backup. Keep a copy of that one small file somewhere safe and apart from the backups. Restoring on a new server: install, restore the backup, copy the key file back and run sudo noclensctl restart. Without the key, audits and reports are all there and you enter the device passwords again.

A device's SSH key changed

NocLens records each device's SSH key the first time it connects and refuses a device that later shows another one (no password is sent). If you really replaced or re-keyed the device, check the new key on its console, then run sudo noclensctl forget-hostkey <ip>; the next audit records the new key.

Updates

sudo noclensctl update --check
sudo noclensctl update

An update takes a backup first, installs the new version and checks that NocLens answers. If it does not, the previous version is put back automatically.

Users and roles

sudo noclensctl add-user ali engineer
sudo noclensctl reset-password ali
sudo noclensctl list-users

Changing a password signs that user out everywhere.

All commands

noclensctl status            health, containers, disk, last backup
noclensctl logs [audit|wall|proxy]
noclensctl start | stop | restart
noclensctl backup | restore FILE
noclensctl update [--check]
noclensctl setup-code
noclensctl add-user NAME ROLE | reset-password NAME | list-users
noclensctl ca-cert
noclensctl support-bundle    logs for support, with IP addresses and secrets removed