Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Current »

This quick start guide will help Accenture MDR customers configure CyberArk Privileged Threat Analytics to send logs to the Log collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

CyberArk Privileged Threat Analytics

LCP

514 (UDP) or

601 (TCP)

Default port

Configuring CyberArk Privileged Threat Analytics

  1. On Privileged Threat Analytics machine, open the default systemparm.properties file using DEFAULTPARM command.

  2. Copy the line containing the syslog_outbound property, and exit the file.

  3. Run a command - LOCALPARM  to open the local systemparm.properties file.

  4. Click 'i' to edit the file

  5. Uncomment the syslog_outbound property in the file.

  6. Paste the line you have copied on step-2 and edit the parameters.

Note: Refer the below table and example given

7. Save the configuration file and close it.

8. Restart Privileged Threat Analytics.

Use the following table as a guide:

Parameter

Value

siem

HP ArcSight

protocol

UDP/TCP

port

514/601

host

The Host/IP address of the LCP

format

CEF

Example: 

syslog_outbound=[{"siem": "HP ArcSight ", "format": "CEF", "host": "LCP_MACHINE_ADDRESS", "port": 514, "protocol": "UDP"}]

LCP Configuration Parameters

Table 1-2: The CyberArk Privileged Threat Analytics event collector (Syslog - 3948) sensor properties to be configured by MDR are shown in the table.

Property

Default Value

Description

Protocol

UDP

The default protocol for syslog. The collector can also accept logs in TCP.

Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the Accenture Security MDR onboarding team.

IP Address

Custom value

Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ).

Note: If the device sends logs using multiple interfaces, contact the Accenture Security MDR onboarding team.

Signatures

|CyberArk|PTA|

MDR recommended signatures processed by the CyberArk PTA collector.

Port Number

514

The default port number for syslog. For TCP, the default port is 601.

Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture Security MDR onboarding team if this is a requirement.



  • No labels