Accenture MDR Quick Start Guide for McAfee® Network Security Manager Intrushield

This quick start guide will help Accenture MDR customers configure McAfee® Network Security Manager (NSM) Intrushield to allow log collection from the Log Collection Platform (LCP).

The guide details the CLI configuration process. Please refer to the vendor document for more information on the GUI configuration.

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at

Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring McAfee NSM Intrushield

To configure McAfee NSM Intrushield with MySQL database, follow the steps below.

1. Login to MySQL CLI as an administrator by doing one of the following steps:

• For Unix-based Operating Systems (OS), at the Unix prompt, enter the following command: mysql -u root -p

• For Windows OS, 

  • Go to Start > All Programs, right-click Command prompt, and select Run as administrator.

  • In the Command Prompt window, navigate to the MySQL installation folder and enter the command: mysql -u root -p 

2. Run any database shell that works with MySQL. For example: SQuirreL SQL client and MySQL Workbench (Query Browser).

3. Type the password for the root account.

4. To assign read-only permission to a user, enter the following command: 

• If the collector is installed on the same host as the database then type the command: grant select on <database_name> * to '<readonly_user_name>' identified by '<password>';

• To give access to a specific host, type the command: grant select on <database_name> * to '<readonly_user_name>' @ '<LCP IP Address or DNS resolvable hostname>' identified by '<password>';

• To give access to any host, type the command: grant select on <database_name> * to '<readonly_user_name>' @'%' identified by '<password>';

5. To reload the grant table, type the command: flush privileges

6. Enter quit

Sample ​Command Output

The read-only database user that is created must have read-only access to the following tables:

• iv_alert

• iv_alert_type

• iv_attack

• iv_signature

• iv_categories

• iv_subcategories

• iv_direction

• iv_result_set

• iv_sensor

• iv_prs

• iv_packetlog

• iv_policy

 Note: Disable “alert suppression settings" in the IPS Alerting option.

LCP Configuration Parameters

Table 1-2: McAfee NSM Intrushield event collector(DB-3654) properties to be configured by MDR are shown in the table.