Accenture MDR Quick Start Guide for OSSEC

This quick start guide will help Accenture MDR customers configure OSSEC to send logs to the Log collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring OSSEC
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

OSSEC server

LCP

514 (UDP) or

601 (TCP)

Default port

Configuring OSSEC

The syslog output allows an OSSEC manager to send OSSEC alerts to the LCP server. As OSSEC sends alerts via syslog, these options are only for server or local installations.

Note: OSSEC supports only Linux/Mac/Solaris for server. Syslog configurations should be done only on the server. OSSEC supports Windows systems as agents not as servers.

To configure OSSEC, follow the steps below:

Login to the server by the SSH console with a root user, on which OSSEC Server (Manager) is installed.

2. Open the OSSEC configuration using the path: /var/ossec/etc/ossec.conf

3. Append the following syslog configuration module: (the sample can be found in /var/ossec/etc/ossec.conf.sample)

<syslog_output>

<server><LCP/Syslog Server IP></server>

<port>514</port>

<format>cef</format>

</syslog_output>

4. By Default, OSSEC monitors the below locations for logs:

/var/log/messages

/var/log/authlog

/var/log/xferlog

/var/log/maillog

/var/www/logs/access_log

/var/www/logs/error_log

You can add entries for specific log files which are to be monitored on OSSEC server/agent.

Example entries for OSSEC system events and active response alerts in /var/ossec/etc/ossec.conf are as follows:

<localfile>

<location>/var/ossec/logs/ossec.log</location>

<log_format>syslog</log_format>

</localfile>

<localfile>

<location>/var/ossec/logs/active-responses.log</location>

<log_format>syslog</log_format>

</localfile>

5. For specific log monitoring on agent computers, location entries should be added to the client’s (where agent is installed) configuration file, that is at/var/ossec/etc/ossec.conf, same as the server’s configuration mentioned in Step4.

6. After this change has been made, the client-syslog process should be enabled using the command: # /var/ossec/bin/ossec-control enable client-syslogFinally restart the OSSEC processes using the command: # /var/ossec/bin/ossec-control restart

LCP Configuration Parameters

Table 1-2: The OSSEC event collector(Syslog-3770) properties to be configured by MDR are shown in the table.

Property	Default value	Description
Protocol	UDP	The default protocol for syslog. The collector can also accept logs in TCP.
IP Addresses	OSSEC server interface IP address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture MDR onboarding team.
Signatures	Trend Micro Inc.\|OSSEC HIDS	MDR recommended signatures processed by the OSSEC event collector.
Port Number	514	The default port number for syslog. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MDR onboarding team if this is a requirement.