Accenture MxDR Quick Start Guide for Claroty Continuous Threat Detection

This quick start guide will help Accenture MxDR customers configure Claroty Continuous Threat Detection to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring CTD

If the user is connected to a CTD Server and configures the Syslog from within that site, the syslog message will be sent from that site and there will not be an option from that site to select the other sites.

If the user is connected to the EMC and defines a new syslog, the message will be forwarded from the EMC Server (and not from the site/s). 

To configure Syslog from Claroty Site :

• Navigate to Settings -> Integrations -> SIEM Syslog

Open

• Uncheck Local as we are sending logs to another target.

Below points are mapped exactly as per the reference screenshot:

1. From (Site) – Select one or multiple sites (i.e. CTD Servers) from the dropdown

2. Message Contents – select which level to log:  Alerts, Baselines, Events. Make category selected is "ALL".

3. Message Format – Select CEF

4. Server – Host/IP of the LCP

5. Port – 514 or 601 or 6514 (based on the protocol used)

6. Protocol – UDP or TCP or TLS 

7. System URL – Automatically shows the source URL; this field is not editable

8. Save – Choose to commit your entries

Open

To configure Syslog from EMC Server :

1. Login to EMC (need user with admin access)

2. Navigate to Settings > Integrations > SIEM Syslog

3. Click the “+” to Create New. 

4. Enter Configuration

a.To: Uncheck “LOCAL” because we are sending logs to a remote server

b.From: Select one or multiple CTD sites or ALL from which your want to send syslog for

c.Vendor name: Select vendor as “Other”

d.Select Alerts, Baselines, Events from Message Contents drop-down and select ALL from Category drop-down.

e.Message Format – Select CEF

f.Type – This dropdown enables you to select one, several or all Alert Types

g.Server – Host/IP of the LCP

h.Port – 514 or 601 or 6514 (based on the protocol used)

i.Protocol – UDP or TCP or TLS 

j.System URL – Automatically shows the source URL; this field is not editable and does not need to be configured

k.Save – Choose to commit your entries.

LCP Configuration Parameters

Table 1-2: The Claroty Continuous Threat Detection event collector (Syslog -3949) properties to be configured by Accenture are given in the table.