Accenture MDR Quick Start Guide for Digital Guardian

This quick start guide will help Accenture MDR customers configure Digital Guardian to send logs to the Log collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Digital Guardian
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MSS Supported Products List document (Accenture_MSS_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

Digital Guardian

LCP

514 (UDP) or

601 (TCP)

Default port

Configuring Digital Guardian

You have to configure "Data Export" on Digital Guardian Management console to push Syslog to LCP.

To create the Data Export source

a) Start the Data Export Wizard from the Data Export page

b) Hover your cursor over Workspace in the Digital Guardian Management Console and select Data Export from the list. The Data Export page opens.

c) Import the pre-defined "Data Export" xml file provided by Accenture MDR engineer.

2. Set Up Data Export Details

a) Select the type of data to export and the type of export to use.

b) Select Alerts from the Data source drop-down list.

c) Choose Syslog from the Export type drop-down list.

d) Choose the desired Type of protocol from the drop-down list, to forward the logs to the LCP.

e) Enter the IP address of the LCP

f) Enter the port number and select the level as Alerts

g) Enable the Is Active check box

3. Click Next to continue until the Review page

The following fields are selected by the pre-defined XML file.

Agent_Local_Date

Agent_Local_Time

Agent_UTC_Time

Alert_ID

Application

Computer_Name

Computer_Type

Email_Sender

Email_Subject

Operation

Policy

Rule

Severity

User_Response

Was_Blocked

Destination_Directory

Destination_File

Destination_File_Encryption

DNS_Hostname

Email_Recipient

IP_Address

Local_Port

Network_Direction

Printer

Printer_Jobname

Protocol

Remote_Port

Source_Directory

Source_File

Source_File_Encryption

URL_Path

Was_Destination_Classified

Was_Source_Classified

Source_Drive_Type

Source_Device_ID

Destination_Drive_Type

Destination_Device_ID

Email_Address

User_Name

Custom_Int_4

Custom_String_1

Custom_String_3

Custom_String_4

Detail_Event_ID

Event_Display_Name

Registry_Value

Source_Device_Friendly_Name

Source_Device_Product_ID

Source_Device_Product_Name

Source_Device_Serial_Number

Source_Device_Vendor

Source_Device_Vendor_ID

Destination_Device_Friendly_Name

Destination_Device_Product_ID

Destination_Device_Product_Name

Destination_Device_Serial_Number

Destination_Device_Vendor

Destination_Device_Vendor_ID

Detail_File_Size_MB

Prompt_Survey_Text

Event_ID

Block_Code

4. Review the Data Export

Review the data source selections and then test the search query before the data source is saved.

Note: This step is required. The data export cannot be saved if the query fails.

5. Save Your Data Export Configuration

Once the Data Export configuration is saved, your data export source becomes available. It becomes visible on the Data Exports page, and the exported data becomes available to your third party application or on the destination server.

Modify the name for the data export in Name text box.
Enter a description for the data export in Description text box (optional)

LCP Configuration Parameters

Table 1-2: Digital Guardian event collector (Syslog -3833) sensor properties to be configured by MSS are shown in the table.

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog. The collector can also accept logs in TCP. Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the Accenture MDR onboarding team.
IP Address	Digital Guardian interface IP address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture MDR onboarding team.
Signatures	Was_Blocked=	MSS recommended signatures processed by the Digital Guardian event collector.
Port Number	514	The default port number for syslog. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MDR onboarding team if this is a requirement.