Skip to main content
Support & Downloads

Help when you need it. Downloads when you don't.

Troubleshoot your appliance, download virtual machine images, or raise a support ticket — your named analyst is never more than an email away.

Troubleshooting

Step-by-step guides for local and VM appliance issues.

Raise a Ticket

Submit a support request and your analyst will respond within one business hour.

Downloads

Virtual appliance images for VMware, Hyper-V, Proxmox and KVM.
Troubleshooting

Local & VM Appliance Troubleshooting

Work through the steps below before raising a ticket. Most issues resolve within minutes and your analyst will have already been alerted automatically.

Local (Physical) Appliance

Appliance Not Powering On

  1. Confirm the power cable is seated firmly at both ends.
  2. Check that the mains socket and any power strip are switched on.
  3. Look for the blue power LED on the front panel — it should illuminate within 5 seconds.
  4. If no LED appears, try a different power cable or mains outlet.
  5. If the issue persists, raise a hardware ticket — we will ship a replacement next business day.

No Network Connectivity

  1. Verify the WAN cable (LAN1 port) is connected to your ISP router or modem.
  2. Check that at least one internal LAN cable (LAN3–LAN6) connects to your switch.
  3. Confirm link lights are active on both the appliance and the switch.
  4. Power-cycle the appliance by holding the power button for 5 seconds, then restarting.
  5. If DHCP clients cannot obtain addresses, restart the appliance — the DHCP service recovers automatically.
  6. If the problem continues, raise a ticket and include which ports have active link lights.

Web Console Not Loading

  1. Open a browser and navigate to https://<appliance-ip> (the IP shown on your deployment sheet).
  2. If the page times out, confirm your device is on the same LAN subnet as the appliance.
  3. Clear your browser cache or try an incognito/private window.
  4. Try an alternative browser — the console supports Chrome, Firefox, Edge, and Safari.
  5. If the console still does not load, restart the appliance and allow 2 minutes for all services to initialise.

VPN Tunnel Not Connecting

  1. Confirm the appliance has internet access by checking the WAN status indicator on the console.
  2. Verify that UDP ports 500 and 4500 are not blocked by your upstream firewall or ISP.
  3. Restart the appliance — the VPN service re-establishes the tunnel automatically on boot.
  4. If you are behind a double-NAT (e.g. ISP CGNAT), contact your ISP to request a public IP or raise a ticket for an alternative backhaul method.

Virtual Machine (VM) Appliance

OVA Import Fails

  1. Verify the download completed successfully — compare the SHA-256 checksum shown on the downloads page with the downloaded file.
  2. Ensure your hypervisor meets the minimum requirements: 4 vCPU, 16 GB RAM, 500 GB disk.
  3. On VMware, use File > Deploy OVF Template (not “Open”).
  4. On Hyper-V, convert the VMDK to VHDX first using qemu-img convert or StarWind V2V Converter.
  5. On Proxmox, import via qm importovf <vmid> appliance.ova local-lvm.
  6. If the import still fails, raise a ticket with your hypervisor version and error message.

VM Network Adapter Issues

  1. The VM requires at least two network adapters: one for WAN and one for LAN.
  2. Adapter 1 (WAN) should be bridged or connected to your external/internet-facing network.
  3. Adapter 2 (LAN) should be connected to the internal virtual switch your endpoints use.
  4. On VMware, set both adapters to VMXNET3 for best performance.
  5. On Hyper-V, ensure the virtual switch type is External for WAN and Internal or Private for LAN.
  6. After changing adapters, restart the VM to allow the appliance to re-detect network interfaces.

VM Performance Problems

  1. Confirm the VM is allocated at least 4 vCPU and 16 GB RAM — reducing either will cause detection delays.
  2. Ensure the virtual disk is on SSD-backed storage; spinning disks significantly impact Suricata and Zeek performance.
  3. Disable any host-level antivirus scanning of the VM’s disk files (VMDK/VHDX).
  4. On VMware, enable Hardware Virtualisation (VT-x/AMD-V passthrough) in the VM settings.
  5. Check that the hypervisor host itself has adequate free resources — over-subscription causes contention.

Appliance Updates & Recovery

  1. Updates are applied automatically via the secure VPN backhaul — no manual action is required.
  2. If an update appears stuck, restart the appliance and allow 10 minutes for the update service to resume.
  3. To check the current appliance version, log in to the web console and navigate to System > About.
  4. If you need to restore from backup, raise a ticket — your analyst will guide you through the recovery process.
  5. Never re-image or reinstall the OS manually; this will void your configuration and require a fresh deployment.
Raise a Ticket

Can't resolve it? We're on it.

Submit a support ticket and your named analyst will respond within one business hour. For critical issues, call the SOC directly — the number is on your deployment sheet.

Response SLA Critical: 30 min · High: 1 hr · Normal: 4 hrs
Coverage 24 / 7 / 365 — UK-based SOC analysts

Your information is transmitted securely and handled in accordance with our privacy policy.

Virtual Appliance Downloads

Deploy on your own hypervisor

Download the virtual appliance image for your platform. Each OVA is pre-configured and connects to the SOC automatically via encrypted VPN backhaul once imported and powered on.

SOC in a Box — Virtual Appliance

Full security appliance with IDS/IPS, NDR, SIEM correlation, DecoyPulse deception, DNS sinkhole, and web management console.

4 vCPU / 16 GB RAM / 500 GB disk VMware · Hyper-V · Proxmox · KVM OVA format · ~8 GB
Request Download Link

DecoyPulse — Deception Appliance

Standalone honeypot appliance with realistic device profiles — Windows Server, Windows 11, NAS, and Linux Server. Zero false positives.

1 vCPU / 2 GB RAM / 20 GB disk VMware · Hyper-V · Proxmox · KVM OVA format · ~2 GB
Request Download Link

Download links are provisioned individually for each customer and expire after 48 hours. Your analyst will send a secure link once your request has been verified.

Download the SOC in a Box Brochure

Everything you need to know in one document — features, pricing, deployment, and how SOC in a Box replaces seven security invoices with one.

Download Brochure (PDF)

One box. One analyst. One invoice.
Eight years of AI behind it.

Book a 30-minute scoping call. We'll map your current security spend, show you what you can cancel, name your analyst, and quote your price — with no obligation.

Book your scoping call

5 working days to live monitoring · Next-day UK delivery · Cancel anytime