Accenture MDR Quick Start Guide for CyberArk Privileged Threat Analytics (PTA)

This quick start guide will help Accenture MDR customers configure CyberArk Privileged Threat Analytics to send logs to the Log collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring CyberArk Privileged Threat Analytics
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

CyberArk Privileged Threat Analytics

LCP

514 (UDP) or

601 (TCP)

Default port

Configuring CyberArk Privileged Threat Analytics

On Privileged Threat Analytics machine, open the default systemparm.properties file using DEFAULTPARM command.
Copy the line containing the syslog_outbound property, and exit the file.
Run a command - LOCALPARM to open the local systemparm.properties file.
Click 'i' to edit the file
Uncomment the syslog_outbound property in the file.
Paste the line you have copied on step-2 and edit the parameters.

Note: Refer the below table and example given

7. Save the configuration file and close it.

8. Restart Privileged Threat Analytics.

Use the following table as a guide:

Parameter	Value

Parameter	Value
siem	HP ArcSight
protocol	UDP/TCP
port	514/601
host	The Host/IP address of the LCP
format	CEF

Example:

syslog_outbound=[{"siem": "HP ArcSight ", "format": "CEF", "host": "LCP_MACHINE_ADDRESS", "port": 514, "protocol": "UDP"}]

LCP Configuration Parameters

Table 1-2: The CyberArk Privileged Threat Analytics event collector (Syslog - 3948) sensor properties to be configured by MDR are shown in the table.

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog. The collector can also accept logs in TCP. Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the Accenture Security MDR onboarding team.
IP Address	Custom value	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture Security MDR onboarding team.
Signatures	\|CyberArk\|PTA\|	MDR recommended signatures processed by the CyberArk PTA collector.
Port Number	514	The default port number for syslog. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture Security MDR onboarding team if this is a requirement.