Accenture MDR Quick Start Guide for Acalvio ShadowPlex

This quick start guide will help Accenture MDR customers configure Acalvio ShadowPlex to send logs to the Log Collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table1-1: Port requirements for LCP communication.

Configuring Acalvio ShadowPlex

1. Click Setup from the ShadowPlex Admin Console menu.

2. On the Global Configuration page, navigate to the SIEM Integration tab.

3. Select the SIEM system from the left-hand menu that the enterprise uses.

4. Select HP ArcSight, RSA NetWitness or Generic from the list of Splunk, HP ArcSight, IBM QRadar, RSA NetWitness, or any other Generic SIEM system.

5. Slide to enable SIEM Integration.

6. Enter the Hostname or IP Address of the LCP server.

7. Enter the Port where the LCP is configured to listen for data . Click (+) to increase the Port number or Click (-) to decrease the Port value.

8. Select the Protocol (UDP or TCP) from the drop-down menu. This is the protocol that will be used by ShadowPlex to connect and push the logs to LCP.

9. The value in Message Format is pre-populated as CEF. This defines the format in which the incidents data from ShadowPlex is posted on to the LCP

Note: Collector supports the CEF format as we get richer set of information in a structured manner.

  10. Specify the Syslog Timezone.

11. If a Generic SIEM System is used, then additional fields for Username and Password is required.

12. These values are mandatory fields for ShadowPlex to be able to connect and push the logs into the Generic SIEM System.

LCP Configuration Parameters

Table 1-2: The Acalvio ShadowPlex event collector (Syslog -3866) properties to be configured by MDR are shown in the table.