Accenture MDR Quick Start Guide for Snort Syslog

This quick start guide will help Accenture MDR customers configure Snort Syslog to send log collection from the Log Collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Snort
4 LCP Configuration parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
Snort	LCP	UDP / 514 or TCP / 601	Default port and protocol

Configuring Snort

Device configuration for Log collection:

I. Steps to forward logs from Snort v2.x deployed on Linux OS Based device

Login to the Snort device using terminal.
Edit the file - /etc/snort/snort.conf
Go to 6) Configure output plugins
Add following entry
# syslog output alert_syslog: host=LCP_IP:514, LOG_AUTH LOG_ALERT Example : output alert_syslog: host=10.0.2.15:514, LOG_AUTH LOG_ALERT
Save the /etc/snort/snort.conf file.
Start the snort service.
Stop the rsyslog service
Edit the file - /etc/rsyslogd.conf
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional *.* @@LCP_IP:514 Example : *.* @@10.0.2.15:514
Start the rsyslog service.

II. Steps to forward logs from Snort v3.1.53 deployed on Linux OS Based Device (Tested in Ubuntu v22.04.2)

Login to the Snort device using terminal.
Stop the rsyslog and snort Services.
Navigate to the Snort Installation Directory /usr/local/etc/snort/ and edit Snort Configuration file -snort.lua

Snort installation directory can be any custom path in which you installed Snort.

4. Under configure outputs options append the following code :

alert_syslog =
    {
            facility = 'local3',
            level = 'info',
    }

You can use any facility and level as per your requirement. Here, we have configured it as local3.

5. Save the Snort Configuration File.

6. Navigate to the rsyslog service's default configuration files directory /etc/rsyslog.d. Create a new file -

3-snort.conf.

7. Add any of the following configurations in 3-snort.conf file depending whether you want to send logs

over either TCP or UDP.

Sending Logs Over TCP

Sending Logs Over UDP

8. Save the File.

9. Start Rsyslog and then Snort service respectively.

LCP Configuration parameters

Table 1-2: The Snort syslog collector(Syslog-3913) properties to be configured by MDR are shown in the table.

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog.
IP Address	Device IP Address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture MDR onboarding team.
Signatures	snort:	MDR recommended signatures processed by the snort syslog event collector.
Port	514	The default port number for syslog. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MDR onboarding team if this is a requirement.