Accenture MDR Quick Start Guide for Snare Epilog

This quick start guide will help Accenture MDR customers configure Snare Epilog to send logs to the Log collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Note: Epilog for Linux platforms are not supported currently by Accenture MDR.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Epilog on Windows

The Epilog application can collect messages from the standard Windows eventlog, as well as from custom devices which store their logs on Windows box. This application reads the messages from three standard eventlogs and forward them to the LCP.

To configure the Epilog application to forward logs to the LCP, follow the steps below. 

Download Epilog

1. Open your browser and go to the link: https://www.intersectalliance.com/our-product/snare-agent/file-format-agents/snare-epilog-for-windows/

2. Fill the details as directed on the screen and download the Epilog agent.

3. After the download is complete, install the agent.

Configure Snare Epilog

1. Go to Start > Search Program and Files > Epilog For Windows.

2. You can also open Epilog For Windows by navigating to Start > All Programs > Intersect Alliance, and then click Epilog For Windows.

3. Double-click Epilog For Windows. You will see Epilog Agent UI in the browser. You can also use any other browser to open the Epilog agent. The URL for the Epilog agent is: http://localhost:6162/.

4. In the left pane, click Log Configuration.

Open

5. Click the Add button.

6. Under Select the Log type, select Custom Log Format from the drop-down list.

7. In the multi-line format, check Single Line Only.

8. Check Send Comments.

9. Provide the log directory path under Log File or Directory.

10. You can add Log Name Format if you have any specific logfile to read.

Open

11. Check one of the options Last Matching File, First Matching File, or All Matching File to match the file pattern.

12. Click Change Configuration to save your changes.

Configure Network Configuration

Global Event Filters

1. Click Network Configuration.

2. In the right pane, provide the following details:

• Destination Snare Server address - Type the IP address of the LCP.

• Destination Port - Type10013 as the port for Non-TLS and 10014 for TLS. 

Note: Custom TCP ports can also be added. 

• For Use UDP, TCP or TLS, select TCP for Non-TLS or TLS for TLS.

• For EPS Rate Limit, type 100000 as the Output EPS rate.

• Click Change Configuration.

If you want to send logs over TLS, follow the steps in Importing Certificate for TLS Support.

Importing Certificate for TLS Support

1. To generate a cert in the LCP, execute the following command: openssl s_client -connect :10014 -showcerts | sed -ne '/-BEGINCERTIFICATE-/,/-END CERTIFICATE-/p' > ./cert.pem

2. Copy this cert in the folder: C:\Program Files\Epilog

3. After the change in configuration, restart the Epilog service from sevices.msc.

 Note: The TLS certificate can be imported with the help of MDR Operations.

LCP Configuration Parameters

Table 1-2: The Snare event collector(Syslog-3241) properties to be configured by MDR are shown in the table.