Accenture MDR Quick Start Guide for Semperis Directory Services Protector

This quick start guide will help Accenture MDR customers configure Semperis Directory Services Protector to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Semperis Directory Services Protector

1. Go to the settings page by clicking on the setting icon on the left side bottom corner.

2. Click on SIEM Integration

3. Primary Syslog Server: Provide LCP IP/hostname

4. Primary Port: 6514

5. Click Use TLS toggle to switch the value to Yes

6. Client Certificate for Secure Two-Way Communication: Please reach out to Accenture MxDR team for certificate details.

7. Polling Frequency: Provide how often(in seconds) the syslog is to poll DSP for new events

Open

Use the Change Event Filtering pane on the Settings > SIEM Integration page to specify the change events to be sent to the monitoring system

To specify the change events to be forwarded, enter the following information:

• Attributes: Use the first drop-down to specify if an attribute is to be included or excluded. Use the second drop-down to select one or more attributes to be included or excluded and by including or excluding attributes, you are filtering logs to be forwarded. MxDR recommend to leave this as blank, we support all logs.

• Classes: Use the first drop-down to specify if a class is to be included or excluded. Use the second drop-down to select one or more classes to be included or excluded and by including or excluding classes, you are filtering logs to be forwarded. MxDR recommend to leave this as blank, we support all logs.

• Operations:Use the drop-down to select one or more operations. Please leave this as blank, we support all type of operation logging.

• AD Changed Items: Enable this toggle to send the AD change events to the syslog server.

• Partitions: Use the drop-down to select the partitions from which change events are to be forwarded.

• DNS: Enable this toggle to send DNS change events to the syslog server.

• Send Operations Log to SysLog: Enable this toggle to send the DSP operation log to the Syslog server.

Open

LCP Configuration Parameters

Table 1-2: The Semperis Directory Services Protector event collector (Syslog -3984) properties to be configured by Accenture are given in the table.