Accenture MDR Quick Start Guide for Attivo BOTsink

This quick start guide will help Accenture MDR customers configure Attivo BOTsink to send logs to the Log collection Platform (LCP).

1 Supported Versions
2 Port Requirements
3 Configuring Attivo BOTsink
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

Attivo BOTsink

LCP

601 (TCP)

Default port

Configuring Attivo BOTsink

Create a syslog profile:
1. Click the Administration button and select Management > Syslog.
2. Click Add in the Syslog Profiles section.
3. Enter a name, which enables you to identify the syslog profile.
4. BOTsink generates the syslog messages with value as Attivo for Device Vendor. Use default value as Attivo.
5. The Manager tags all the syslog messages with the string "BOTsink" to enable you to identify BOTsink messages in the syslog server. Use default value as BOTsink.
6. Make sure the Events Forwarding is set to enabled.
7. Select event severity as the criterion. Select “very-low“
8. The BOTsink severity of events is mapped with that of syslog severity (RFC 5424). Use as default.
9. Select message format as CEF.
10. Enable Faults Forwarding.
11. Enable Audit Logs Forwarding.
12. Click Save.
Create a syslog server record:
1. Click the Administration button and select Management > Syslog.
2. To add a syslog server details, click Add in the Syslog Server section.
3. Tick the check-box to enable message forwarding.
4. Enter the name of syslog server.
5. Select the profile name which you have created above.
6. Enter LCP IP Address
7. Enter port number as 601
8. Select protocol as TCP
9. Save the configuration
10. Test connection

LCP Configuration Parameters

Table 1-2: The Attivo BOTsink event collector (Syslog -4000) properties to be configured by Accenture are given in the table.

Property	Default Value	Description
Protocol	TCP
Host Names / IP Addresses	*	Hostname/Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture Security Onboarding team.
Signatures	\|Attivo\|BOTsink\|	Accenture Security recommended signatures processed by the Attivo BOTsink event collector.
Port Number	601	The default port for TCP Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture Security Onboarding team if this is a requirement.