Accenture MDR Quick Start Guide for Symantec Data Loss Prevention using Syslog Configuration

This quick start guide will help Accenture MDR customers configure Symantec Data Loss Prevention (DLP) to send the logs to the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

 Port Requirements

Table1-1: Port requirements for LCP communication.

 Configuring Symantec DLP

DLP supports two methods for generating Syslog events. They are Syslog Response Rule notifications and Syslog Server Alerts.

 Note: Currently the Syslog Response Rule is supported by MSS

 Creating a Syslog Response Rule

1. On the Enforce Manager Console, Navigate to the Tab Manage > Policies > Response Rules.

2. Select Configure Response Rule under Response Rules option and give a rule name.

Open

3. Choose Log to a Syslog Server as the action from the drop-down menu.

4. Enter the LCP IP address in the Host field.

5. Enter the default port 514 in the Port field.

6. Enter the Message as given below:

|symcdlpsys|APPLICATION_NAME|$APPLICATION_NAME$|APPLICATION_USER|$APPLICATION_USER$|ATTACHMENT_FILENAME|$ATTACHMENT_FILENAME$|BLOCKED|$BLOCKED$|DATAOWNER_NAME|$DATAOWNER_NAME$|DATAOWNER_EMAIL|$DATAOWNER_EMAIL$|DESTINATION_IP|$DESTINATION_IP$|ENDPOINT_DEVICE_ID|$ENDPOINT_DEVICE_ID$|ENDPOINT_LOCATION|$ENDPOINT_LOCATION$|ENDPOINT_MACHINE|$ENDPOINT_MACHINE$|ENDPOINT_USERNAME|$ENDPOINT_USERNAME$|PATH|$PATH$|FILE_NAME|$FILE_NAME$|PARENT_PATH|$PARENT_PATH$|INCIDENT_ID|$INCIDENT_ID$|INCIDENT_SNAPSHOT|$INCIDENT_SNAPSHOT$|MACHINE_IP|$MACHINE_IP$|MATCH_COUNT|$MATCH_COUNT$|OCCURRED_ON|$OCCURRED_ON$|POLICY|$POLICY$|RULES|$RULES$|PROTOCOL|$PROTOCOL$|QUARANTINE_PARENT_PATH|$QUARANTINE_PARENT_PATH$|RECIPIENTS|$RECIPIENTS$|REPORTED_ON|$REPORTED_ON$|SCAN|$SCAN$|SENDER|$SENDER$|MONITOR_NAME|$MONITOR_NAME$|SEVERITY|$SEVERITY$|STATUS|$STATUS$|SUBJECT|$SUBJECT$|TARGET|$TARGET$|URL|$URL$|USER_JUSTIFICATION|$USER_JUSTIFICATION$|

7. Choose the Level as Debugging from the drop-down menu.

8. Once assigned to a Policy, the Response Rule will generate a syslog event when triggered.                         

Open

LCP Configuration Parameters

Table 1-2: The Symantec DLP event collector (Syslog -3859) sensor properties to be configured by MSS are shown in the table.