Accenture MDR Quick Start Guide for AppOmni

This quick start guide will help Accenture MDR customers configure AppOmni to collect logs to the Log collection Platform (LCP).

This document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring AppOmni
4 Create an IAM User
5 Retrieve access key and access key ID
6 LCP Configuration Parameters:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
LCP	AWS SQS	443 (TCP)	Default Port

Configuring AppOmni

Section 1 - AWS S3 Configuration & IAM User Creation

Creation of S3 bucket

Navigate to https://s3.console.aws.amazon.com/
Click Create Bucket
Provide a name for the S3 bucket
Click Create Bucket

Create an IAM User

Create an IAM user with upload access to the bucket. Please reference the AWS documentation, Controlling access to a bucket with user policies, for instructions on performing this step.

Follow below document for IAM user permission:
Accenture MDR Quick Start Guide in Configuring IAM User and KMS Key Policies

Retrieve access key and access key ID

Login to AWS console with the user created in above step.
In the AWS console, select your account name and, in the drop-down menu, select Security credentials.

In Access keys, select Create access key. After creation, copy the keys from the Access key and Secret access key fields.

Section 2: Configure Destination in AppOmni Console

Log into your AppOmni console
Navigate to Threat detection > Destinations
Click Add Destination

Search for Amazon Web Services and click on that.

Click Continue

Fill below details and rest everything should be default.

a. Name - Mention the name

b. Description (Optional)- Mention the description

c. AWS region name - Provide the AWS S3 bucket region

d. AWS access key - Provide the Secret Access key which we have created in previous steps

e. AWS access key ID - Provide the Access Key which we have created in previous steps

f. AWS bucket name - Provide the S3 bucket name where you want to store the logs

g. Delivery Format - Select JSON line

7. Click on Save

Once the destination has created, check if it is enabled or not. If it is not enabled than enable it.
Review the JSON files in the S3 bucket.

Section 3: Create SQS and attach with S3

Refer this document: Accenture MDR Quick Start Guide in Configuring AWS Simple Queue Service (SQS) with S3 Storage

Prerequisite: Following is the IAM user policies required for SQS:

SQS:

IAM User Permission: SQS

{
“Action”: [
“sqs:GetQueueAttributes”,
“sqs:GetQueueUrl”,
“sqs:ReceiveMessage”,
“sqs:DeleteMessage”,
“sqs:ListQueues"
],
“Effect”: “Allow”,
“Resource”: “arn:aws:sqs:region:accountID:SQSName”
}

S3:

IAM User Permission: S3

{
"Effect": "Allow",
"Action": ["s3:ListBucket","s3:GetObject"],
"Resource": ["arn:aws:s3:::bucketname", "arn:aws:s3:::bucketname/*"],
"Condition": {}
}

When KMS encryption is enabled in Appomni for s3 or SQS or for both, IAM users also need KMS permission to decrypt:

KMS:

IAM User Permission: KMS

{
 
"Effect": "Allow",
"Action": "kms:Decrypt",
"Resource": "arn:aws:kms:AWS_Region:AWS_account_ID:key/key_ID"
}

If in case SQS and s3 both are encrypted with different KMS keys, add two resources in the above KMS policy with comma-separated values.

The above policies are IAM user policies.

If SQS is encrypted, please add below policy in KMS. This policy is required to make s3 events notify SQS:

KMS Policy

LCP Configuration Parameters:

Table 1-2: AppOmni Event collector (API - 3939) properties to be configured by MDR are given in the table.

Property	Default Value	Description
Region		Enter region (Eg: us-east-1)
Secret Access ID		Based on the Account ID
Secret Access Key		Based on the Account ID
Logging Source	SQS	Though S3 and cloud watch are available in the drop-down, in this case, please select SQS only.
S3 Bucket/Log Group(s)/SQS Queue URL		Provide SQS Queue URL
Bucket Prefix Path(s)		No need to provide in case of SQS URL