This quick start guide will help Accenture MDR customers configure Trend Micro™ Deep Discovery™ Inspector to send logs to the Log Collection Platform (LCP).
The document includes the following topics:
Supported Versions
Port Requirements
Configuring Trend Micro Deep Discovery Inspector
LCP Configuration Parameters
Supported Versions
A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in
Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents
Port Requirements
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
Trend Micro Deep Discovery Inspector | LCP | 514 (UDP) or 601 (TCP) | Default port |
Configuring the Trend Micro Deep Discovery Inspector
You can use any one of the below option based on the Trend Micro Deep Discover Inspector Version.
Configuring Trend Micro Deep Discover Inspector Version 3.6 - 4.0
Configuring Trend Micro Deep Discover Inspector Version 5.0
Configuring Trend Micro Deep Discover Inspector Version 3.6 - 4.0
Login to the admin console of Deep Discovery Inspector over SSL using: https://IPofappliance.
After successful authentication, go to Logs > Syslog Server Settings as shown below.
Figure 1-1: The Deep Discovery Inspector console.
3. Under Syslog Servers, click Add to create a Syslog configuration. The Add Syslog Server page appears as shown below.
Figure 1-2: The Add Syslog Server page.
4. Check the Enable syslog server checkbox to configure the Syslog server.
5. In the IP address text box, type the lcp_ip_address.
6. In the Port text box, type 514 (the default and recommended port is 514 for UDP, 601 for TCP).
7. Select UDP or TCP as protocol.
Note: SSL is not supported.
8. From the Facility level drop-down list, select any facility level. This is important only when you bind the Syslog server to any specific Facility level. The recommended value is local0.
9. From the Severity level drop-down list, select Informational.
10. In Log Format , select Trend Micro Event Format.
Note: MDR supports only Trend Micro Event Format which is identical to CEF but holds some critical information.
11. Under Detection logs and System event logs, check Select all so all logs will be forwarded.
12. Click Save.
Configuring Trend Micro Deep Discover Inspector Version 5.0
Login to the admin console of Deep Discovery Inspector over SSL using: https://IPofappliance.
After successful authentication, go to Administration > Integrated Product and Services as shown below
Figure 1-3: The Deep Discovery Inspector console.
3. In left pane, go to Syslog tab.
Figure 1-4: Integrated Product and Services
4. Click Add to create a Syslog configuration. Add Syslog Server page appears as shown below.
Figure 1-5: The Add Syslog Server page
5. In the IP address text box, type the lcp_ip_address.
6. In the Port text box, type 514 (the default and recommended port is 514 for UDP, 601 for TCP).
7. Select UDP or TCP as protocol.
Note: SSL is not supported.
8. From the Facility level drop-down list, select any facility level. This is important only when you bind the Syslog server to any specific Facility level. The recommended value is local0.
9. From the Severity level drop-down list, select Informational.
10. In Log Format , select Trend Micro Event Format.
Note: MSS supports only Trend Micro Event Format which is identical to CEF but holds some critical information.
11. Under Detection logs and System event logs, check Select all so all logs will be forwarded.
12. Click Save.
LCP Configuration Parameters
Table 1-2: The Trend Micro Deep Discovery Inspector event collector properties to be configured by MDR are shown in the table.
Property | Default Value | Description |
Transport Protocol | UDP | The default protocol for syslog. The LCP can also accept logs in TCP. Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the MDR onboarding team. |
IP Address |
| Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture Security MDR onboarding team. |
Signatures | Trend Micro,Deep Discovery Inspector | MDR recommended signatures processed by the Trend Micro Deep Discovery Inspector event collector. |
Port | 514 | The default port for syslog. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the MDR onboarding team if this is a requirement. |