Accenture MDR Quick Start Guide for Sidewinder G2

This quick start guide will help Accenture MDR customers configure Sidewinder G2 to send logs to the Log collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Sidewinder G2

The Sidewinder G2 device supports the following syslog formats: acat, ascii, Sidewinder Export Format (SEF), W3C Extended Log Format (HTTP), and WebTrends (WELF). If Sidewinder G2 7.0.1.02 or higher is installed, the ascii syslog format should be used. Otherwise, use the acat format. The collector supports both Sidewinder G2 version 6 and 7, see To configure Sidewinder G2 version 6 to send audit data to a syslog server. Sidewinder G2 version 7 Admin Console provides a file editor which allows you to edit the files on the Sidewinder appliance. Do not use it. Instead, use a text editor to edit the files. See To configure Sidewinder G2 version 7 to send audit data to a syslog server.

To Configure Sidewinder G2 Version 6 to Send Audit Data to a Syslog Server

1. Login to Sidewinder G2 using an SSH client or the serial console and type the following command to switch to an administrative role: srole

2. Navigate to the auditd.conf file. For Sidewinder G2 version 6, the default location is /etc/sidewinder/.

3. Using a text editor, edit the auditd.conf file.

4. Specify acat (or ascii for Sidewinder G2 version 7.0.1.02 or higher) as the type of audit logging to be sent to the syslog server.

5. Add the following line at the end of the auditd.conf file: syslog (facility filters ["filter"] format)

• Facility - Information that is associated with a syslog message. For example, you can use local0 through local7 as names for the facility; they are predefined in the syslogd file.

• Filter - Name of Sidewinder sacap filter to use in the output. The filter value must be set to ["NULL"].

• Format - Output format. The format value must be set to acat (or ascii for Sidewinder G2 version 7.0.1.02 or higher).                                                   

6. Save and close the auditd.conf file.

7. Look up the syslog Process ID (PID) by typing the following command: pss syslog

8.To implement the changes, you must restart the syslog and auditd processes by typing the following commands: 

To Configure Sidewinder G2 Version 7 to Send Audit Data to a Syslog Server

1. Login to Sidewinder G2 using an SSH client or the serial console and type the following command to switch to an administrative role: srole

2. Navigate to the auditd.conf file. For Sidewinder G2 version 7, the default location is /secureos/etc/.

3. Using a text editor, edit the auditd.conf file.

4. Specify acat (or ascii for Sidewinder G2 version 7.0.1.02 or higher) as the type of audit logging to be sent to the syslog server.

Add the following line at the end of the auditd.conf file: syslog (facility filters ["filter"] format)

• Facility - Information that is associated with a syslog message. For example, you can use local0 through local7 as names for the facility; they are predefined in the syslogd file.

• Filter - Name of Sidewinder sacap filter to use in the output. The filter value must be set to ["NULL"].

• Format - Output format. The format value must be set to acat (or ascii for Sidewinder G2 version 7.0.1.02 or higher).

5. Save and close the auditd.conf file.

6. Specify where the syslog server will send syslog messages.

• Using a text editor, open the /etc/syslog.conf file.

• Add the following line at the end of the syslog.conf file: facility.* @ IP_address

7. To prevent redundant logging:

• Change this line: *.notice;auth,...uccp.non /var/log/messages to *.notice;auth,...uccp,facility.none /var/log/messages

• Save and close the syslog.conf file.

8. Restart the syslog and auditd processes by typing the following commands: cf daemond restart agent=syslog cf daemond restart agent=auditd

LCP Configuration Parameters

Table 1-2: The Sidewinder G2 event collector properties to be configured by MDR are shown in the table.