Accenture MDR Quick Start Guide for Trend Micro™ Deep Discovery™ Inspector

This quick start guide will help Accenture MDR customers configure Trend Micro™ Deep Discovery™ Inspector to send logs to the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

 Configuring the Trend Micro Deep Discovery Inspector

You can use any one of the below option based on the Trend Micro Deep Discover Inspector Version.

• Configuring Trend Micro Deep Discover Inspector Version 3.6 - 4.0

• Configuring Trend Micro Deep Discover Inspector Version 5.0

Configuring Trend Micro Deep Discover Inspector Version 3.6 - 4.0

1. Login to the admin console of Deep Discovery Inspector over SSL using: https://IPofappliance.

2. After successful authentication, go to Logs > Syslog Server Settings as shown below.

Open

3. Under Syslog Servers, click Add to create a Syslog configuration. The Add Syslog Server page appears as shown below.

Open

4. Check the Enable syslog server checkbox to configure the Syslog server.

5. In the IP address text box, type the lcp_ip_address.

6. In the Port text box, type 514 (the default and recommended port is 514 for UDP, 601 for TCP).

7. Select UDP or TCP as protocol.

Note: SSL is not supported.

8. From the Facility level drop-down list, select any facility level. This is important only when you bind the Syslog server to any specific Facility level. The recommended value is local0.

9. From the Severity level drop-down list, select Informational.

10. In Log Format , select Trend Micro Event Format. 

Note: MDR supports only Trend Micro Event Format which is identical to CEF but holds some critical information.

11. Under Detection logs and System event logs, check Select all so all logs will be forwarded.

12. Click Save.

Configuring Trend Micro Deep Discover Inspector Version 5.0

1. Login to the admin console of Deep Discovery Inspector over SSL using: https://IPofappliance.

2. After successful authentication, go to Administration > Integrated Product and Services as shown below

3. In left pane, go to Syslog tab.​

4. Click Add to create a Syslog configuration. Add Syslog Server page appears as shown below.

5. In the IP address text box, type the lcp_ip_address.

6. In the Port text box, type 514 (the default and recommended port is 514 for UDP, 601 for TCP).

7. Select UDP or TCP as protocol.

Note: SSL is not supported.

8. From the Facility level drop-down list, select any facility level. This is important only when you bind the Syslog server to any specific Facility level. The recommended value is local0.

9. From the Severity level drop-down list, select Informational.

10. In Log Format , select Trend Micro Event Format.

 Note: MSS supports only Trend Micro Event Format which is identical to CEF but holds some critical information.

 11. Under Detection logs and System event logs, check Select all so all logs will be forwarded.

12. Click Save.

LCP Configuration Parameters

Table 1-2: The Trend Micro Deep Discovery Inspector event collector (Syslog - 3764 )properties to be configured by MDR are shown in the table.