Accenture MDR Quick Start Guide for Cybereason

This quick start guide will help Accenture MDR customers configure Cybereason to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Cybereason
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

LCP

Cybereason Login URL

443

Port number mentioned in the login URL.

https://[hostname]:[port]/login.html

Configuring Cybereason

To create a user

Log in to Cybereason GUI with Admin privilege user.
Navigate to Administration > Users > Create Users.
Enter User Details email and password.
Choose API User from Predefined roles.
Click Add user

6. After user creation, execute login API to get login cookies in API followed by Malop and Malware API execution to fetch desired logs.

Note: With the user created above, we only get machine name in logs. To fetch IPs of the machines, we need to create user with following permissions (without below permission, we still able to fetch malware/malop logs, but it helps to resolve machine names to IPs):

a) To collect the source IP, we need to set the following:

b) Enable Malware Feature

Go to Security Profile Page > Anti Malware feature and turn on Anti Malware feature as shown below:

Rest of the settings should be done as per organizations security policy.

c) Anti Ransomware Feature

Go to Security Profile Page > Anti Ransomware feature and turn on Anti Ransomware feature as shown below:

Select anyone option from Detect, suspend and prevent from above selection and rest of the settings should be done as per organizations security policy.

d) Power Shell Feature

Go to Security Profile Page > Power shell protection feature and turn on PowerShell feature as shown below:

Rest of the settings should be done as per organizations security policy.

LCP Configuration Parameters

Table 1-2: The Cybereason collector properties (API -3851) to be configured by MSS are shown in the table.

Property	Default Value	Description
Cybereason Login URL	Custom Value	Cybereason Login API URL mentioned in the Pre-Installation Questionnaire (PIQ). e.g: https://[hostname]:[port]/login.html
Company name	Custom Value	Name of the company mentioned in the PIQ e.g:.Accenture(Without Space and any special symbol)
User name	Custom Value	API user name mentioned in the Pre-Installation Questionnaire (PIQ).
Password	Custom Value	API user password mentioned in the Pre-Installation Questionnaire (PIQ).