Accenture MDR Quick Start Guide for FireEye ETP

This quick start guide will help Accenture MDR customers configure FireEye ETP to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements         

Table 1-1: Port requirements for LCP communication.

Configuring FireEye ETP

To configure API Keys, perform the following steps.

1. Log in to the ETP Web Portal or IAM console.

2. Click on My Settings in the top navigation bar

Open

3. Click the API Keys tab in the IAM console.

4. Click Create API Key.

Open

5. On the Manage API Key page, specify the following:

• API Key Name

• Expiration time for the API Key. If the API Keys should be set for 100 days then enter 100d or if it is for 1 year then enter 1y.

• Select both Email Threat Prevention and Identity Access Management in Products field.

6. Select all entitlements as shown below:

For any API access, the following entitlements are required:

• iam.users.browse

• iam.orgs.self.read

For accessing alerts APIs, the following additional entitlements are required:

• etp.alerts.read

For accessing trace APIs, the following additional entitlements are required:

• etp.email_trace.read

For accessing quarantine APIs, the following additional entitlements are required:

• etp.quarantine.update

• etp.quarantine.read

• etp.quarantine.delete

7. To download or copy an API key, click the download or copy icon in the bottom right corner.

8. Click Create API Key.

Creating New Request for Monitoring

Once the device is configured as outlined in the steps above and all network pre-requisites have been made, you are now ready to onboard it for MDR monitoring. To complete this process, submit a New Request via the MDR Portal. This new request should contain the following information:

1. Reporting LCP Hostname/IPAddress:

2. Fireeye ETP URL

3. API Key: 

Note: If you have any questions about this process, please contact the Accenture MDR onboarding team.

LCP Configuration parameters

Table 1-2: The FireEye ETP event collector (API -3910) properties to be configured by MDR are shown in the table.