Accenture MDR Quick Start Guide for Kaspersky™ Security Center

This quick start guide will help Accenture MDR customers configure Kaspersky™ Security Center to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Kaspersky Security Center

To configure Kaspersky Security with Microsoft SQL database for the LCP to collect logs, follow the steps below.

Based on Kaspersky DB architecture, you can configure the DB with:

• Creating a database user account for Microsoft SQL

• Creating a database user account for MySQL

To create a database user account as an Admin user:

1. Open Microsoft SQL Server Management Studio and connect to the Microsoft SQL Server 2008 R2 machine containing the database as an admin user.

2. In the Object Explorer that appears on the left-hand pane of SQL Server Management Studio, right-click Security and go to New > Login.

3. In the Login – New window, do the following in the same sequence:

• Select the General page.

• Type a login name for the new user.

• Select SQL Server authentication, create a password for the user and confirm the password.

• Uncheck the User must change password at next login check box.

• Under Default database, select the database to be read by the user.

• Select the Server Roles page.

• Under Server roles, select public.

• Select the User Mapping page.

• Under Users mapped to this login, make sure that the database to be read is selected.

• Under Database role membership for <database_name>, select the following:

a. public

b. db_datareader

• Click OK.

Connecting to MS-SQL server as a non-admin user

1. Open Microsoft SQL Server Management Studio.

2. In the Object Explorer that appears on the left-hand pane of SQL Server Management Studio, click the Connect icon.

3. In the Login window, do the following:

   1. Select Server Type as Database Engine.

   2. Enter the Server Name as selected during installation.

   3. Select the Authentication Type as SQL Server Authentication.

   4. Enter the login name and password, and click Connect.

 Note: After you are connected, you can run queries, as required, to view the logs.

You must create a database user account for MySQL to view logs in the MySQL database.

1. Open MySQL program.

2. Enter the username and password and click Connect to connect to the server as a root user.

3. After connecting to the server as a root user, create a new read-only user with the required privileges by executing the following commands:

 Note: In the command line, you must replace username, hostname, database name, read-only user name, and password with actual values.

4. After you have finalized the permissions that you want to set up for new users, always be sure to reload all the privileges by executing the following command:

a. FLUSH PRIVILEGES;

5. Type quit to exit SQL shell.

LCP Configuration Parameters

Table 1-2: The Kaspersky Security Center event collector(DB-3730) properties to be configured by MDR are shown in the table.