Accenture MDR Quick Start Guide for Symantec™ Advanced Threat Protection (ATP) API Logging Configuration
- Sekar Venkataramani
- KS
This quick start guide will help Accenture MDR customers configure Symantec™ ATP to allow log collection from the Log Collection Platform (LCP).
The document includes the following topics:
Supported Versions
Port Requirements
Configuring Symantec ATP
Creating New Request for Monitoring
LCP Configuration Parameters
Supported Versions
A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents
Port Requirements
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
LCP | Symantec ATP | 443 (https) | Default port |
Configuring Symantec ATP
Log in to ATP Appliance via Web UI with your Admin credentials.
Go to Settings and select the Data Sharing.
3. Click Add Application.
4. Enter the Application name for the LCP.
5. Select the Enable v2 APIs Radio button and select the Role as an User from dropdown box.
6. Click Generate.
7. Copy the ClientID and Client Secret value and share it with MSS Team.
8. Click Done.
Note: This device is not a cloud device and it doesn't have a cloud API. When a Log Collection Platform (LCP) pulls logs from the device, then it directly query the device to pull logs using the https (443) connection.
Creating New Request for Monitoring
Once the device is configured as outlined in the steps above and all network pre-requisites have been made, you are now ready to onboard it for MSS monitoring. To complete this process, submit a New Request via the MSS Portal at https://mss.accenture.com/. This new request should contain the following information:
Reporting LCP Hostname/IP Address:
Symantec ATP URL:
Client ID:
Client Secret:
Client Name:
If you have any questions about this process, please contact your Onboarding Engineer or Service Manager.
LCP Configuration Parameters
Table 1-2: The Symantec ATP API collector (API - 3846) properties to be configured by MSS are shown in the table.
Property | Default Value | Description |
Symantec ATP URL | Custom Value | Symantec ATP API URL mentioned in the Pre-Installation Questionnaire (PIQ). (e.g.: https://192.168.1.148) |
Client_id | Custom Value | Client_id mentioned in the PIQ. (e.g.: O2ID.atp-cusomer.atp-domain.fur0njvhhlbig7tiq9lv1|smut) Note: Value captured in step7. |
Client_Secret | Custom Value | Client_secret will be the password associated with the client_id mentioned in the PIQ. (e.g.: 1kmocctcriqeod6hhdmkpcsstmfl7u9vk7ke) Note: Value captured in step7. |
Client_name | Custom Value | Name of the ATP appliance name or IP address from the ATP URL. |
Legal Notice
Copyright © 2021 Accenture. All rights reserved.
Accenture, the Accenture Logo, and DeepSight Intelligence are trademarks or registered trademarks of Accenture in the U.S. and other countries. Other names may be trademarks of their respective owners.
The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Accenture and its licensors, if any.
THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. ACCENTURE SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer Software - Restricted Rights" and DFARS 227.7202, et seq. "Commercial Computer Software and Commercial Computer Software Documentation," as applicable, and any successor regulations, whether delivered by Accenture as on premises or hosted services. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.