Accenture MDR Quick Start Guide for Tenable Operational Technology

This quick start guide will help Accenture MDR customers configure Tenable Operational Technology to send logs to the Log Collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture MSS - Log in to MSS

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Tenable Operational Technology

To set up a Syslog Server using the Management Console UI, follow the below steps,

1. In the Management Console UI, under Local Settings, navigate to Servers > Syslog Servers screen

2. Click + Add Syslog Server. The Syslog Servers configuration window is displayed

Open

3. In the Server Name field, enter the name of a Syslog Server(LCP) to be used for logging system events.

4. In the Hostname/IP field, enter a host name or an IP address of the LCP

5. In the Port field, enter the port number (UDP: 514 or TCP: 601)

6. In the Transport field, select from the dropdown list the transport protocol to be used. Options are: TCP or UDP.

7. If you would like to send a test message to verify that the configuration was successful, click Send Test Message, and check if the message has arrived.

8. Click Save.

Note : The above setting does not include forwarding of system logs.

To configure the system to send System Events to a Syslog server, follow below steps:

1. Navigate to the Local Settings > System Log screen

2. In the header bar, click on Select syslog sever. A dropdown list of servers is displayed.

3. Select the desired server which created earlier.

LCP Configuration Parameters

Table 1-2: The Tenable Operational Technology event collector(Syslog-4011) properties to be configured by MDR are shown in the table.