Accenture MDR Quick Start Guide for Websense® Cloud Web Security

This quick start guide will help Accenture MDR customers configure Websense® Cloud Web Security to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication

Configuring Cloud Web Security

Note: By default, the complete traffic logging feature is not available. To enable all logging features in your account, contact the Websense Support team. Once all the features are available, you can configure the Cloud Web Security portal to generate and retain detailed log information.

 To create a new administrator contact, follow the steps below.

 Note: Websense strongly recommends that the log download process has its own username and password to gain access to the Cloud Web Security service. This keeps the process separate from other administration tasks and enables you to establish longer password expiration policies.

1. In the Cloud Security portal, from the main menu, go to Account > Settings.

2. Click Contacts.

3. In the Contacts section, click Add.

Open

4. In the First name and Surname fields, enter identifying information for the new contact. For example, "Traffic" and "Logging."

5. Click Submit.

Open

6. In the User Name field, to add a user name, select Click here.     

7. Enter a password for the contact. It must conform to the password policy on the main Contacts page.

8. Enter a password expiration date for the contact. This should be different than the regular account settings; it should span a longer period. The maximum period is 365 days.

9. Under Account Permissions, check the Full Traffic Logging check box, and any other permission you want to give this "user". You can act as an administrator from this login.

Note: Ensure that the Full Traffic Logging and View Reports check boxes are checked to apply permission to the user account.

To enable log retention for your account, follow the steps below.

1. In the Cloud Security portal, on the main menu, click Web.

2. From the drop-down menu, under SETTINGS, click Full Traffic Logging.

3. On the Full Traffic Logging screen, click Edit.

4. Check the Enable full Web traffic logging check box.

5. Click Submit.

 Note: Accenture Security Websense Cloud Web Security event collector reads logs from the Websense cloud log portal and does not retain any of the customer logs/log files from the cloud. Regular deletion of the log files from the cloud by any means is the sole responsibility of customers to avoid disabling of the "Full Traffic Logging" feature from their account. No traffic will be logged once the feature is disabled.

 LCP Configuration Parameters

Table 1-2: The Websense Cloud Web Security event collector properties to be configured by MDR are shown in the table.