This quick start guide will help Accenture MDR customers configure Sniper IPS to send logs to the Log Collection Platform (LCP).
...
Server IP Address - Type the LCP IP Address
Port - The default port value is 514 for UDP. You can provide any custom port value.
Sniper ID - Type the Sniper ID
Interworking with control device - Select Syslog from the list.
Note: Only UDP protocol is supported by the Sniper IPS. Sniper ID in the syslog configuration has to be only numeric characters and it should be unique for each individual Sniper IPS.
6. Click Add.
...
LCP Configuration Parameters
Table 1-2: The Sniper IPS event collector(Syslog-3788) properties to be configured by MDR are shown in the table.
Property | Default Value | Description |
Transport Protocol | UDP | This indicates what protocol is used by the sensor to communicate with the Sniper IPS. Note: This collector does not support TCP and Syslog Director/Relay or Syslog Aggregator based environment due to device limitation. |
IP Address | Sniper IPS interface IP address | Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture MDR onboarding team. |
Signatures | [SNIPER- | MDR recommended signatures processed by the Sniper IPS event collector. |
Port | 514 | The default port for UDP. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MDR onboarding team if this is a requirement. |
...