Page Comparison

...

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

...

You must configure Sophos Enterprise Console to work with the event collector by following the steps below.

...

1. Create a read-only database user account for Microsoft SQL Server.anchor

2. mixedauthmixedauthSet the Microsoft SQL server security mode to mixed authentication. Anchor

3. readonlywinreadonlywinCreate a read-only database user with Windows Account for Microsoft SQL Server. Anchor

4. nondynamicnondynamicConfigure the SQL Server instance to listen on a non-dynamic port. Anchor

5. sslsslConfigure an SSL connection for the Microsoft SQL Server JDBC driver. Anchorsensorsensor

6. Configure the sensor properties for Windows user accounts.

​I. 

To create a read-only database user account for Microsoft SQL Server, follow the steps below.

...

GRANT SELECT ON vThreatEventData to 'account_name';

go

quit

II. 

To set the Microsoft SQL server security mode to mixed authentication, follow the steps below.

...

1. On the left pane, right-click the appropriate server, and then click Properties.

2. In the Server Properties window, select Security.

3. In the Server Authentication section, select SQL Server and Windows Authentication mode.

4. Click OK and then click Close.

III. 

To create a read-only database user with Windows Account for Microsoft SQL Server, follow the steps below.

...

1. Open SQL Server Management Studio.

2. Login to the SQL Database with Admin privileges.

3. In Object Explorer, expand the Databases folder. Expand the database in which you want to create the new database user.

4. Right-click the Security folder, point to New, and select Logins….

5. In the Database User – New dialog box, on the General page, select Windows Authentication.

6. In the User name box, from the User type list, select Windows user. You can also click Search (…) to open the Select User or Group dialog box.

7. In the Default Database box, specify the database that will own objects created by this user.

8. On the User Mapping page, select the databases that this login can access. When you select a database, check the Map check box.

9. Specify a database user to map to the login. Provide the username you created in the above steps.

10. Specify the default schema of the user. When a user is first created, its default schema is dbo.

11. From the Database role membership for Database drop-down list, select db_datareader.

12. Click Ok.

IV. 

To configure the SQL Server instance to listen to network requests on a non-dynamic port, follow the steps below.

...

• In TCP/IP Properties, on the IP Address tab, make sure that Active and Enabled are both set to Yes.

• Make sure that TCP Dynamic Ports is blank for the IP address that the collector connects to.

• Make sure that TCP Port contains the value 1433 for the IP address that the collector connects to.

V. 

 Note: This step is needed only if Secure Sockets Layer (SSL) connection is a requirement.

...

  6. Restart the SQL Server. Click SQL Server Services and then right-click SQL-SERVER and Restart.

VI. 

Note: To set up Windows Authentication with Accenture security database event collectors, you must use off-box collection. You cannot use this setup with on-box collection.

...

4. In the Collector configuration, for the database sensor setting, add the string ;integratedSecurity=true to the end of the Database URL.

For example: jdbc:jtds:sqlserver://hostname:1433/database_name;integratedSecurity=true

5. In the collector's database sensor setting, remove any values entered in the username and password fields.

...