Accenture MDR Quick Start Guide for Alibaba Cloud Firewall

This quick start guide will help Accenture MDR customers configure Alibaba Cloud Firewall to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Alibaba Cloud Firewall

Prerequisite:

• Log Audit Service is enabled. Please refer: Enable log collection - Log Service - Alibaba Cloud Documentation Center

• RAM user is created. If you are using same RAM user account to configure firewall to log data in log service and API key/secret is sharing with MxDR to pull logs, please provide AliyunLogFullAccess permission to the user.

• If separate RAM user API key & secret are provided to MxDR to query logs from log service, please provide AliyunLogReadOnlyAccess permission to the RAM user. Grant a RAM user the permissions to query and analyze logs of Cloud Firewall - Cloud Firewall - Alibaba Cloud Documentation Center

• Log analysis feature is enabled. Please refer Enable the log analysis feature - Cloud Firewall - Alibaba Cloud Documentation Center

Device configuration for Log collection:

Please follow below steps to enable log collection on firewall:

1. Log on to the Cloud Firewall console.

2. In the left-side navigation pane, choose Log Analysis > Log Analysis.

3. In the upper-right corner of the Log Analysis page, turn on internet_log.

Open

The log collection feature of Cloud Firewall is enabled. All the traffic logs of Cloud Firewall are automatically imported to a dedicated Logstore.

For sensor configurations, we need details for endpoint, project and logstore. Please follow below steps to get project details:

1. Log on to the Simple Log Service console.

2. In the Projects section, you will find a project in the format cloudfirewall-project-<Alibaba_Cloud_account_ID>-<region>

3. Copy and share the project name.

Please follow below steps to get endpoint:

An endpoint is a region-specific URL that you can use to access Simple Log Service. Simple Log Service provides endpoints for different network types, such as the Internet or an Alibaba Cloud internal network.

1. In the Projects section, click the name of the project that you want to manage.

2. On the Project Overview page of the project, view the endpoints for the region where the project resides.

Open

Please refer following document for more endpoint details:

Endpoints - Log Service - Alibaba Cloud Documentation Center

We also need API Access key and secret for the RAM user. Please follow below steps:

1. Log on to the RAM console using your Alibaba Cloud account.

2. In the left-side navigation pane, click Users. On the displayed page, click the target user name to access the user details page

3. In the User Access Key area, click Create Access Key

4. After completing the phone verification, on the Create User Access Key page, expand Access Key Details to view the AcessKeyId and AccessKeySecret. Click Save Access Key Information.

5. Click Authorize on the right of the RAM user to grant permissions

Permissions required:

• AliyunLogReadOnlyAccess

Note: After the AccessKey is created, it cannot be viewed in the console. You must copy your AccessKey properly and keep it confidential.

LCP Configuration Parameters 

Table 1-2: The Alibaba Cloud Firewall event collector (API - 5075) properties to be configured by MDR are shown in the table.