Accenture MDR Quick Start Guide for Symantec Protection Engine NAS (Network Attached Storage)

This quick start guide will help Accenture MDR customers configure Symantec Protection Engine NAS to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

 Note: While using the Unix based syslog collector to send logs , the port for Symantec Protection Engine NAS collector should be changed from 514 to any other UDP port to avoid conflict.

Configuring Symantec Protection Engine NAS

Symantec Protection Engine NAS stores the events in log files. Accenture Security recommends NxLog Agent to be used for Symantec Protection Engine NAS log collection.

Log configuration via NxLog Agent in Windows

1. Log in to Symantec Protection Engine device using Administrator Credentials

2. Select Monitors from the left Menu Panel

3. Click on logging under Views

4. Select the option Warning from the Windows Logging level drop-down menu

5. Click on Save and Deploy                                                                                                   

Open

To configure the NxLog Agent in Windows you can use any of the below:

• Windows NxLog Agent

• Windows NxLog Agent using TCP with TLS

1. Download and Install NxLog agent from location https://nxlog.co/products/nxlog-community-edition/download

2. Navigate to services.msc and stop the nxlog service

3. Navigate to C:\Program Files (x86)\nxlog\data and delete configcache.dat

4. For Windows Agent, go to installed location C:\Program Files (x86)\nxlog\conf 

5. Rename the attached nxlog.conf file to nxlog.conf and move the file into this folder.

Open

6. Replace LCP_IP_Address with actual LCP IP address in nxlog.conf against Host

7. Now start the nxlog service from services.msc

8. NxLog Agent logs will be available at the location C:\Program Files (x86)\nxlog\data\nxlog.log

1. Download and Install NxLog agent from location https://nxlog.co/products/nxlog-community-edition/download

2. Navigate to services.msc and stop the nxlog service

 Note: Please contact the Accenture Security MSS onboarding team to obtain the certificate.

3. Place the certificate into NAS server which is obtained from the MSS onboarding team at your desired location.

4. Navigate to C:\Program Files (x86)\nxlog\data and delete configcache.dat

5. For Windows Agent, go to installed location C:\Program Files (x86)\nxlog\conf

6. Rename the attached nxlog.conf(WinTLS) file to nxlog.conf and move the file into this folder.

Open

7. Replace LCP_IP_Address with actual LCP IP address in nxlog.conf against Host

8. Provide the CA File location at position 44

9. Now start the nxlog service from services.msc

10. NxLog Agent logs will be available at the location C:\Program Files (x86)\nxlog\data\nxlog.log

Log configuration via NxLog Agent in Unix

1. SSH the Linux machine where the SPE Server is installed.

2. Navigate to /opt/SYMCScan/bin/ and open configuration.xml in VI editor

3. In Logging section, change the Syslog log level to 3

4. Save the file

                <LogDir value="/opt/SYMCScan/log"/>

                <AlertBindAddress value=""/>

                <LoadExceededAlertInterval value="5"/>

                <LogLocal logfilestokeep="0" loglevel="3"/>

                <LogWindows loglevel="0"/>

                <Syslog loglevel="3"/>

                <LogPopup value="false"/>

                <LogSNMP community="public" loglevel="0" primary="" primaryport="162" secondary="" secondaryport="162"/>

                <LogSMTP domain="" loglevel="0" primary="" secondary="">

5. Restart the Symantec Protection Engine using /etc/init.d/symcscan restart command

To configure the NxLog Agent in Unix , you can use any of the below:

• Unix NxLog Agent configuration using UDP/514

• Unix NxLog Agent configuration using TCP with TLS

1. Download and Install NxLog agent from location https://nxlog.co/products/nxlog-community-edition/download

2. Navigate to the installed location /etc/nxlog.conf and rename the attached nxlog.conf to nxlog.conf and copy into this folder.

Open

3. Replace LCP_IP_Address with actual LCP IP address in nxlog.conf against Host

4. Start the NxLog service using the below command 

           systemctl start nxlog

5. NxLog agent logs can be found at location /var/log/nxlog.log​

Download and Install NxLog agent from location https://nxlog.co/products/nxlog-community-edition/download​

 Note: Please contact the Accenture Security MSS onboarding team to obtain the certificate.

1. Place the certificate into NAS server which is obtained from the MSS onboarding team at your desired location.

2. Navigate to the installed location /etc/nxlog.conf and rename attached nxlog.conf to nxlog.conf and copy into this folder

Open

3. Replace LCP_IP_Address with actual LCP IP address in nxlog.conf against Host

4. Change access.log file location on line 24.

5. Add the CAFile location at position 37.

6. Start the nxlog service using the below command

         systemctl start nxlog

7. NxLog agent logs can be found at location /var/log/nxlog.log

LCP Configuration Parameters

Table 1-2: The Symantec Protection Engine NAS  event collector (Syslog - 5005) properties to be configured by MSS are given in the table.