Accenture MDR Quick Start Guide for Arista NDR

This quick start guide will help Accenture MDR customers configure Arista NDR to send logs to the Log collection Platform (LCP).

This document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Arista NDR
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

Arista NDR

LCP

6514 (Secure_TCP)

Default port

Configuring Arista NDR

Navigate to Awake's Detection Management page.

2. Click + Add New Skill.

3. Set the Expression field to the expression shown below, modifying as needed:

integrations.cef.tcp
{ destination: "<LCP_IP>"
, port: 6514
, secure: true (Enable this to send logs via TLS)
, severity: Warning
, skipNullDevice: false
, awakeHost: "<Device_IP/FQDN of the device>"
}

Note : You can send the SIEM syslog in CEF format via TCP and UDP protocols. MxDR Recommends the send logs in CEF Format only.

4. Set the Title field to a descriptive name.

5. Set the Reference Identifier to something easily discoverable, such as integrations. myorg.mysiem as shown in the following figure. This is an optional setting.

Note: Using this naming convention helps ensure that the hook name does not conflict with future vendor-specific utilities that we may distribute.

6. Click Save.

LCP Configuration Parameters

Table 1-2: The Arista NDR Event Collector (Syslog -4013) properties to be configured by Accenture are given in the table.

Property	Default Value	Description
Protocol	TLS	The default protocol for Secure_TCP.
Host Names / IP Addresses	Arista NDR Interface IP address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact your onboarding team.
Signatures	\|Arista Networks\|Awake Security\|	Accenture Security recommended signatures processed by the Arista NDR event collector.
Port Number	6514	Default port number for UDP.