Accenture MDR Quick Start Guide for Sophos XG Firewall

This quick start guide will help Accenture MDR customers configure Sophos XG Firewall to send logs to the Log collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Sophos XG Firewall

To configure Sophos XG Firewall, follow the steps below.

1. Login to the Web UI.

2. Configure the following settings.

• Syslog Servers – For logs to be sent to the LCP.

• Log Settings - For log types to be sent to the LCP.     

Syslog Servers

1. Go to Configure > System Services > Log Settings. Under the Syslog Servers section, click Add.

2. In the Name text box, type a unique name for the LCP.

3. In the IP Address/Domain text box, type the IP address (IPv4/IPv6) or domain name of the LCP. 

4. In the Port text box, type 514 

5. From the Facility drop-down list, select DAEMON.

6. From the Severity Level drop-down list, select Information.

7. From the Format drop-down list, select Device Standard Format.

8. Click Save.

Open

Log Settings 

To send syslog to the LCP, select the following log types.

• Base Firewall (Security Policy log)

Open

• Web Protection (Web filtering log and Application filtering log)

• Network Protection (IPS log)

• System log

 Note: Both Accept and Deny logs play an important part in the analysis of traffic seen at the firewall. To receive maximum benefit from a firewall logging to MDR, all rules that make up the installed firewall policy including an Explicit Deny All (also known as Clean-Up) rule should be configured to log.

LCP Configuration Parameters

Table 1-2: The Sophos XG Firewall event collector(Syslog-3823) properties to be configured by MDR are shown in the table.