Accenture MDR Quick Start Guide for DenyAll Rweb

This quick start guide will help Accenture MDR customers configure DenyAll Rweb to send logs to the Log collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

 Configuring DenyAll Rweb

To configure DenyAll Rweb to send events logs, follow the steps below.

Note: DenyAll Rweb should be configured to forward logs to the SNMP or syslog server. Syslog log collection is supported. 

To forward logs to syslog server:

1. Login to the Rweb console.

2. Click Setup.

3. In the left pane, select System > Syslog.

Open

Note: The default port number, 514, is used for the syslog server. By default, traffic logs are not forwarded to the configured syslog server. You should enable the traffic log forwarding either through Global setting or application specific setting. As the name suggests, the Global setting takes effect on all applications. The Application specific setting is effective only for specified applications. Once configured, traffic logs and Alert logs are forwarded to the configured syslog server.

Open

Configuring DenyAll Rweb using CLI:

1. Do SSH to connect to the DenyAll Rweb as an Administrator.

2. Navigate to opt > rweb > bin > cli.

3. Enter the command ./CLI and the DenyAll Rweb command interface starts.

4. To view all configured syslog servers, enter the command: setup_syslog show

5. To add the syslog server, enter the following  command: 

 Note: The syslog_server format: [0-255].[0-255].[0-255].[0-255]

• Available Resource Levels - (LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR, LOG_WARNING, LOG_NOTICE, LOG_INFO, LOG_DEBUG)

• Available Traffic Log Facility - (LOG_AUTH, LOG_AUTHPRIV, LOG_CRON, LOG_DAEMON, LOG_FTP, LOG_KERN, LOG_LOCAL (0 TO 7),LOG_LPR, LOG_MAIL, LOG_NEWS, LOG_SYSLOG, LOG_USER, LOG_UUCP)

• Available Alerts Facility - (LOG_AUTH, LOG_AUTHPRIV, LOG_CRON, LOG_DAEMON, LOG_FTP, LOG_KERN, LOG_LOCAL (0 TO 7), LOG_LPR, LOG_MAIL,LOG_NEWS, LOG_SYSLOG, LOG_USER, LOG_UUCP)

6. To delete a syslog server, enter the following command:

setup_syslog set --activate-syslog ON --resource-level LOG_ERR --trafficlog-facility LOG_LOCAL0 --alert-facility LOG_LOCAL0 --del-servers

7. To clear all syslog servers, enter the command: setup_syslog set --activate-syslog OFF --clear-servers

LCP Configuration Parameters

Table 1-2: The DenyAll Rweb event collector (Syslog - 3792) properties to be configured by MDR are shown in the table.