This quick start guide will help Accenture MDR customers configure BeyondTrust Remote Support to send logs to the Log collection Platform (LCP).
This document includes the following topics:
| Table of Contents | ||||
|---|---|---|---|---|
|
Supported Versions
A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.
Port Requirements
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
BeyondTrust | LCP | 514 (UDP) | Default port
|
Configuring BeyondTrust Remote Support
To enable syslog messages from the BeyondTrust Appliance, follow below steps.
Login to the appliance.
Navigate to /appliance > Security > Appliance Administration and scroll down to the Syslog section.
Select Legacy BSD format in the Message Format drop down options and ensure LCP IP address in the Remote Syslog Server.
4.Click Submit.
LCP Configuration Parameters
Table 1-2: The BeyondTrust Remote Support event collector (Syslog -4001) properties to be configured by Accenture are given in the table.
Property | Default Value | Description |
Protocol | UDP | Protocol that LCP uses to receive events. |
Host Names/IP Addresses | * | The default value '*' means all hosts. Possible values are:
|
Signatures | BG[, BG: | The signatures used by the LCP to collect the necessary log events from the logs generated by the BeyondTrust Remote Support. If there are more than one signature, then the signatures must be seperated by a comma (,). If you add a new sensor configuration other than the default one, the Signatures field is empty. Then you must manually enter appropriate signatures. If the Signatures field is empty, the signature based filtering of messages does not happen. |
Enable Signatures | True |
|
Port Number | 514 | The port number to which you have configured to send syslog messages. |