Accenture MDR Quick Start Guide for Dragos

This quick start guide will help Accenture MDR customers configure Dragos Platform to send logs to the Log collection Platform (LCP).

This document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Dragos Platform
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

Dragos Platform

LCP

514 (UDP) or

601 (TCP)

Default port

Configuring Dragos Platform

Log in as an Administrator to begin configuring the specific settings required to make the Dragos Platform send Syslog messages to LCP. To access the Syslog configuration, navigate to the URL <https://<site-store>/syslog/>

NOTE: Ensure to include the final '/' after Syslog. A 404 not found will be returned using just the 'syslog' extension without the trailing ‘/’.

Add a connection -From the Servers Tab in the Syslog integration, click the + ADD SERVER button to create a new destination.

Enter a friendly server name in the NAME field.
Set the hostname or IP address to the proper value to reach the LCP server.
Set the port number.
Set the source hostname
Set the source process name as “dragos_syslog“.
Select the Syslog Message Format 3164.
Use newline character for Message Delimiter.
Click NEXT: SET TEMPLATE to continue.

Configuring Message Content

The Global Message Template manages what content the Syslog integration sends in a message.
The severity translation allows Users to map the Dragos internal severity to the Syslog severity that will appear in the message.
Keep the severity mapping as mentioned below.
Select syslog facility as "3: System deamons"
Select the Output Message Format as CEF (Common Event Format)

The following line should be copied into the dialog without any line breaks or carriage returns.

{ occurred_at="${occurredAt}" app="dragos:platform" body="${content}" category="${summary}" created_at="${createdAt}" dest="${dst_asset_ip}" dest_dragos_id="${dst_asset_id}" dest_host="${dst_asset_hostname}" dest_ip="${dst_asset_ip}" dest_mac="${dst_asset_mac}" dest_name="${dst_asset_domain}" dragos_detection_quad="${detection_quad}" dragos_detector_id="${detector_id}" dvc="${asset_ip}" dvc_dragos_id="${asset_id}" dvc_host="${asset_hostname}" dvc_ip="${asset_ip}" dvc_mac="${asset_mac}" dvc_name="${asset_domain}" id="${id}" ids_type=network severity_id="${severity}" signature="${source}" src="${src_asset_ip}" src_dragos_id="${src_asset_id}" src_host="${src_asset_hostname}" src_ip="${src_asset_ip}" src_mac="${src_asset_mac}" src_name="${src_asset_domain}" subject="${type}" type="alert" vendor_product=" Dragos Platform" }

Select SAVE to create the new destination.

Configuring Notifications

The Dragos Platform allows Users to specify what events and notifications are sent via the Platform to Syslog. Notifications are processed according to a rule set that is configured in the main Platform.

Adding a Rule.

To add a rule, navigate to the Notifications App (labeled 1 below).
Select the Rules Tab (labeled 2 below) from the top of the screen.
Click + ADD NEW RULE button (labeled 3 below) to create a new rule.

LCP Configuration Parameters

Table 1-2: The Dragos event collector (Syslog -3966) properties to be configured by Accenture are given in the table.

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog. The collector can also accept logs in TCP. Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the Accenture Security Onboarding team.
IP Address/Hostname	*	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture Security Onboarding team.
Signatures	dragos_syslog:	Accenture Security recommended signatures processed by the Dragos event collector.
Port Number	514	The default port for UDP. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture Security Onboarding team if this is a requirement.
Enable Signatures	TRUE	Let you enable or disable the signature filtering.
Time Offset	+00:00	Specify a time offset to convert timestamps of all logged events to the time zone of the collector computer