Oracle VirtualBox: CLI (VBoxManage)

Deploy the RTA entirely from the command line using VBoxManage. This guide covers import, firmware configuration, network setup, and starting the VM in a single shell session.

Before you start

Review the VirtualBox overview. You'll need the OVA file from your engagement lead, VirtualBox 7.x installed, and VBoxManage on your PATH. Run VBoxManage --version to confirm.

Quick deploy

Experienced operators can run the sequence below straight through; each step is explained in the sections that follow.

VBoxManage import <OVA_PATH> --vsys 0 --cpus 4 --memory 8192 --vmname "Sophos-RTA"
VBoxManage modifyvm "Sophos-RTA" --firmware efi          # mandatory: BIOS will not boot
VBoxManage modifyvm "Sophos-RTA" --nic1 bridged --bridge-adapter1 "<HOST_NIC>"
VBoxManage startvm "Sophos-RTA" --type gui               # boots pre-registered

--firmware efi is required (VirtualBox defaults to BIOS, which the image will not boot); get <HOST_NIC> from VBoxManage list bridgedifs. There is no activation step.

1. Import the OVA

VBoxManage import <OVA_PATH> \
  --vsys 0 \
  --cpus 4 \
  --memory 8192 \
  --vmname "Sophos-RTA"

--vsys 0 targets the first (and only) virtual system in the OVA. --cpus and --memory override whatever the OVA descriptor specifies: set them to your preferred values (minimum 2 vCPU / 4096 MB).

To preview what the OVA will create before committing:

VBoxManage import <OVA_PATH> --dry-run

2. Enable EFI firmware

This step is mandatory, do not skip it

VirtualBox defaults every new VM to Legacy BIOS. The RTA image uses a GPT disk with an EFI System Partition and will not boot under BIOS. Run this command before starting the VM.

VBoxManage modifyvm "Sophos-RTA" --firmware efi

Secure Boot

Secure Boot is off by default in VirtualBox 7.x; do not enable it. The appliance bootloader is unsigned; enabling Secure Boot prevents the VM from booting.

3. Configure the network adapter (Bridged)

Find the name of the host NIC you want to bridge to:

VBoxManage list bridgedifs

Look for the Name: field of the interface that is connected to the engagement LAN (typically your wired Ethernet adapter).

Name:            en0
...
Status:          Up

Then configure Adapter 1 as a bridged adapter:

VBoxManage modifyvm "Sophos-RTA" \
  --nic1 bridged \
  --bridge-adapter1 "<HOST_NIC>"

Replace <HOST_NIC> with the exact name from VBoxManage list bridgedifs (e.g., en0, eth0, Ethernet).

NAT is fine for isolated lab use

If you are running the appliance in an isolated lab with no real LAN targets, NAT is sufficient for the outbound VPN tunnel. For actual engagements where the appliance must have Layer-2 adjacency to targets, Bridged Adapter is required.

4. Start the VM

With a GUI console window (recommended for first boot, lets you watch the status dashboard):

VBoxManage startvm "Sophos-RTA" --type gui

Headless (no console window, runs in the background):

VBoxManage startvm "Sophos-RTA" --type headless

View the status dashboard from a headless VM

If you started headless and want to see the appliance's status dashboard, reattach a console:

VBoxManage startvm "Sophos-RTA" --type gui

Or use VBoxManage controlvm "Sophos-RTA" vrde on to enable RDP access if VRDE is configured on your host.

Verify

# Check the VM is running
VBoxManage list runningvms

# Show the VM's current configuration (confirm firmware = EFI, nic = bridged)
VBoxManage showvminfo "Sophos-RTA" | grep -E "Firmware|NIC 1"

Expected output:

Firmware:        EFI
NIC 1:           MAC: ..., Attachment: Bridged Interface '<HOST_NIC>', ...

This image is customized for your engagement before you receive it, so the appliance boots already registered and connects to the Sophos headend over its outbound VPN tunnel automatically. There is no activation step. The console shows a live status and troubleshooting dashboard (network interface, VPN tunnel, and connectivity health); you do not normally need to log in.

If you started the VM headless, relaunch with --type gui to view the dashboard.

Network access

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination

Destination	connect.remotetesting.secureworks.com
IP addresses	3.33.194.251 and 15.197.255.2 (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.