Accenture MDR Quick Start Guide for Fidelis Endpoint

This quick start guide will help Accenture MDR customers configure Fidelis Endpoint to send logs to the Log collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Fidelis Endpoint
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
Fidelis Endpoint	LCP	6514 (Secure_TCP)	Default port

Configuring Fidelis Endpoint

Device configuration Steps:

To configure exporting log and result information:

Login to the Fidelis web UI with Admin privileges.
Click on “Configuration”
Click on “SIEM”.
Click on “Add“ to add the SIEM Integration. A pop-up window will get open.

5. Choose template as “ArcSight“

6. In the Details tab enter following details.

Type any name for SIEM integration/Syslog configuration.
Set “Enable” as “True“.
Select “Format” as “CEF“.
Set “Use Host Name“ as “True“.
Select “Destination“ as “Host“.
Enter port number to send logs as “6514”.
Enter LCP address in “Host“ field.
Enable “Use TLS” option to encrypt the log data while sending to syslog destination.
Provide certificate details.
Enter “Header Prefix“ as “CEF:0“.
Enter “Header Delimiter” as “|“. (Pipe).

Note:

To enable System and Server Health Logs is optional. Customer can disable sending these logs to LCP. MxDR supports all log types.
Fields sequence and field names should be as per order given in below tables.

7. In “Alert” tab select following details.

Set “Enable“ as “True“
Set “Use Syslog Header“ as “True“.
Select following Header Fields.

Device Vendor
Device Product
Device Version
Signature ID
Name
Severity

Below are the fields selected by default. Just make sure sequence is matching with the below table.

Name	Value
end	CreateDate
act	endpoint alert
cat	Fidelis Endpoint Alert
msg	Assessment IntelSource SourceType Description
dvchost	Target
cs1Label	Description
cs1	Description
cs2Label	Assessment
cs2	Assessment
cn1Label	Confidence
cn1	Confidence
cs3Label	IntelSource
cs3	IntelSource
cs4Label	ArtifactName
cs4	ArtifactName
cs5Label	AlternateArtifactName
cs5	AlternateArtifactName
Below mentioned highlighted fields are the behaviour fields and should be added manually
hashmd5	HashMD5
hashsha1	HashSHA1
hashsha256	HashSHA256
localip	LocalIP
localport	LocalPort
threatname	ThreatName
url	URL
suser	User
remoteip	RemoteIP
remoteport	RemotePort

Note: Mentioned Green fields in the below screenshots are the behaviour fields and added manually and these fields are added in only “Alert” logs. Rest of the fields are by default selected fields.

8. In “Task Result” tab select following details.

Set “Enable“ as “True“
Set “Use Syslog Header“ as “True“.
Select following Header Fields.

Device Vendor
Device Product
Device Version
Signature ID
Name
Severity

Below are the fields selected by default. Just make sure sequence is matching with the below table.

Name	Value

Name	Value
src	SourceHostIP
shost	SourceHost
dst	DestinationHostIP
dhost	DestinationHost
act	script result
cat	Fidelis Endpoint Script Result

9. In “Audit Logs” tab select following details.

Set “Enable“ as “True“
Set “Use Syslog Header“ as “True“.
Select following Header Fields.

Device Vendor
Device Product
Device Version
Signature ID
Name
Severity

Below are the fields selected by default. Just make sure sequence is matching with the below table.

Name	Value

Name	Value
end	CreateDate
suser	UserName
act	ActivityType
cat	Fidelis Endpoint Activity Log Entry
msg	Message
suid	UserId

10. In “Server Health” tab select following details.

Set “Enable“ as “True“
Set “Use Syslog Header“ as “True“.
Select following Header Fields.

Below are the fields selected by default. Just make sure sequence is matching with the below table.

Name	Value

Name	Value
end	CreateDate
src	HostAddress
cs1Label	CpuUsage
cs1	CpuUsage
cs2Label	MemUsage
cs2	MemUsage
cs3Label	NetUsage
cs3	NetUsage
cs4Label	GatewayCpuUsage
cs4	GatewayCpuUsage
cs5Label	GatewayMemUsage
cs5	GatewayMemUsage
cs6Label	GatewayNetUsage
cs6	GatewayNetUsage
cs7Label	CurrentFilestoreRequests
cs7	CurrentFilestoreRequests
cs8Label	TotalFilestoreRequests
cs8	TotalFilestoreRequests
cs9Label	AverageFilestoreResponseTime
cs9	AverageFilestoreResponseTime
cs10Label	DataStoreEventsQueue
cs10	DataStoreEventsQueue_Size DataStoreEventsQueue_Capacity DataStoreEventsQueue_Total DataStoreEventsQueue_ReQueued DataStoreEventsQueue_Dropped DataStoreEventsQueue_InFlowControl
cs11Label	DataStoreResultsQueue
cs11	DataStoreResultsQueue_Size DataStoreResultsQueue_Capacity DataStoreResultsQueue_Total DataStoreResultsQueue_ReQueued DataStoreResultsQueue_Dropped DataStoreResultsQueue_InFlowControl
cs12Label	JobQueuePost
cs12	JobQueuePost_Size JobQueuePost_Capacity JobQueuePost_Total JobQueuePost_ReQueued JobQueuePost_Dropped JobQueuePost_InFlowControl
cs13Label	MessagesToSendToBusinessServices
cs13	MessagesToSendToBusinessServices_Size MessagesToSendToBusinessServices_Capacity MessagesToSendToBusinessServices_Total MessagesToSendToBusinessServices_ReQueued MessagesToSendToBusinessServices_Dropped MessagesToSendToBusinessServices_InFlowControl
cs14Label	MessagesToSendToGateway
cs14	MessagesToSendToGateway_Size MessagesToSendToGateway_Capacity MessagesToSendToGateway_Total MessagesToSendToGateway_ReQueued MessagesToSendToGateway_Dropped MessagesToSendToGateway_InFlowControl
cs15Label	ScriptResult
cs15	ScriptResult_Size ScriptResult_Capacity ScriptResult_Total ScriptResult_ReQueued ScriptResult_Dropped ScriptResult_InFlowControl
cs16Label	TbBatchQueue
cs16	TbBatchQueue_Size TbBatchQueue_Capacity TbBatchQueue_Total TbBatchQueue_ReQueued TbBatchQueue_Dropped TbBatchQueue_InFlowControl
cs17Label	TbRawQueue
cs17	TbRawQueue_Size TbRawQueue_Capacity TbRawQueue_Total TbRawQueue_ReQueued TbRawQueue_Dropped TbRawQueue_InFlowControl
cs18Label	MessagesReceivedFromEndpointQueue
cs18	MessagesReceivedFromEndpointQueue_Size MessagesReceivedFromEndpointQueue_Capacity MessagesReceivedFromEndpointQueue_Total MessagesReceivedFromEndpointQueue_ReQueued MessagesReceivedFromEndpointQueue_Dropped MessagesReceivedFromEndpointQueue_InFlowControl

11. In “System Logs” tab select following details.

Set “Enable“ as “True“
Set “Use Syslog Header“ as “True“.
Select following Header Fields.

Below are the fields selected by default. Just make sure sequence is matching with the below table.

Name	Value

Name	Value
end	CreateDate
name	Name
act	service log
cat	Fidelis Endpoint Log Entry
msg	Message
sourceServiceName	SourceServiceName
cs1Label	Logger
cs1	LoggerName
cs2Label	Exception
cs2	Exception
thread	ThreadName

LCP Configuration Parameters

Table 1-2: The Fidelis Endpoint event collector (3974 – Syslog) properties to be configured by MDR are shown in the table.

Property	Default Value	Description
Protocol	Secure_TCP	The default protocol for syslog TLS.
IP Address	Fidelis Endpoint IP Address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture MDR onboarding team.
Signatures	\|FidelisEndpoint\|	MDR recommended signatures processed by the Fidelis Endpoint event collector.
Port Number	6514	The default port for Syslog TLS.