Accenture MDR Quick Start Guide for Windows via Palo Alto Cortex XDR

This quick start guide will help Accenture MDR customers configure Windows via Palo Alto Cortex XDR to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table1-1: Port requirements for LCP communication.

Configuring Windows via Palo Alto Cortex XDR

Device configuration for Log collection:

We have to generate the following items from the Cortex XDR app to fetch events from API:

The following steps describe how to generate the necessary key values:

Get your Cortex XDR API Key:

1. In Cortex XDR, navigate to Settings > Configurations > Integrations > API Keys.

2. Select + New Key.

3. Choose the type of API Key you want to generate based on your desired security level:

   1. Advanced or Standard. (MxDR recommend to use Advanced API key because the Advanced API key hashes the key using a nonce, a random string, and a timestamp to prevent replay attacks)

4. If you want to define a time limit on the API key authentication, mark Enable Expiration Date and select the expiration date and time.

5. Provide a comment that describes the purpose for the API key, if desired.

6. Select the desired level of access for this key.

7. Select access role as Viewer

8. Generate the API Key

9. Copy the API key, and then click Done. This value represents your unique Authorization:{key}

Note: You will not be able to view the API Key again after you complete this step. Ensure that you copy it before closing the notification.

Get your Cortex XDR API Key ID

1. In the API Keys table, locate the ID field

2. Note your corresponding ID number

Get FQDN:

1. Right-click your API key and select View Examples

2. Copy the CURL Example URL. The example contains your unique FQDN:

https://api-{fqdn}/public_api/v1/{name of api}/{name of call}/

 Create Target dataset:

• Using present consumes higher compute units. To optimize compute unit usage, vendor has recommended to create custom target dataset and use the dataset to pull logs.

• Please create dataset on the console using below XQL query or contact Vendor Support:

preset = xdr_event_log | filter action_evtlog_provider_name=\"Microsoft-Windows-Security-Auditing\" or action_evtlog_provider_name=\"EMET\" or action_evtlog_provider_name=\"Windows Error Reporting\" or action_evtlog_provider_name=\"Microsoft-Windows-User Profiles Service\" or action_evtlog_provider_name=\"Application Error\" or action_evtlog_provider_name=\"Application Hang\" or action_evtlog_provider_name=\"Microsoft-Windows-Eventlog\"
| target type = dataset append = true Accenture_MXDR

Note: Please make sure to use name Accenture_MXDR as target dataset.

LCP Configuration Parameters

Table 1-2: The Palo Alto Cortex XDR event collector (API- 5009) sensor properties to be configured by MDR are shown in the table.