Accenture MDR Quick Start Guide for Broadcom Symantec Siteminder

This quick start guide will help Accenture MDR customers configure Broadcom Symantec Siteminder to send logs to the Log collection Platform (LCP).

This document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Siteminder
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
Siteminder	LCP	UDP/514 or TCP/601 or TLS/6514	Default port

Configuring Siteminder

Device configuration steps:

I. Steps to configure NxLog Agent on Windows for Log flow over TCP or UDP or TLS (Windows)

Download and Install NxLog agent from location https://nxlog.co/products/nxlog-community-edition/download
Go to services.msc and stop the nxlog service
Go to folder "C:\Program Files\nxlog\data" and delete "configcache.dat"
For Windows Agent , go to installed location “C:\Program Files\nxlog\conf”. Rename below attached “nxlog(windows).txt” to "nxlog.conf" and replace with “nxlog.conf” file which was already present in this folder.

5. Replace “<LCP_IP>” with actual LCP IP in nxlog.conf

6. Change smaccess.log file location on line 29

7. Now start the nxlog service from services.msc

8. NxLog agent logs will be available at location "C:\Program Files\nxlog\data\nxlog.log"

9. Log flow should work and the logs will be seen on the LCP end for destination port on packet capture.

II. Steps to configure NxLog Agent on RHEL for Log flow over TCP or UDP or TLS (Linux RHEL)

Download and Install NxLog agent from location Download (There are few dependencies that you need to install and then you can install nxlog on machine. Refer Documentation :: NXLog Documentation )
For Linux Agent , After installation go to installed location “/etc/nxlog/”. Rename attached “nxlog(Linux)1.txt” to "nxlog.conf" and replace with “nxlog.conf” file which was already present in this folder.

3. Replace “<LCP_IP>” with actual LCP IP in nxlog.conf

4. Change smaccess.log file location on line 24

5. Now start the nxlog service using below command
systemctl start nxlog

6. NxLog agent logs will be available at location "/var/log/nxlog.log"

7. Log flow should work and the logs will be seen on the LCP end for destination port on packet capture.

LCP Configuration Parameters

Table 1-2: Broadcom Symantec Siteminder event collector (Syslog - 3986) sensor properties to be configured by MSS are shown in the table.

Property	Default Value	Description

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog. The collector can also accept logs in TCP and Syslog TLS is also supported. Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the Accenture Security MDR onboarding team.
Host Names/IP Addresses	Siteminder IP	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture Security MSS onboarding team.
Signatures	Broadcom-Siteminder	MDR recommended signatures processed by the Broadcom Symantec Siteminder event collector.
Port Number	514	The default port number for syslog. For TCP, the default port is 601. For syslog TLS, port is 6514 Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MDR onboarding team if this is a requirement.