Accenture MDR Quick Start Guide for Elastic Defend Event Collector

1 Supported Versions
2 Device configuration for Log collection
3 LCP Configuration Parameters

This quick start guide will help Accenture MDR customers configure Guide for Elastic Defend Event Collector.

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture MDR Portal.

Device configuration for Log collection

We need to generate new API key from Kibana GUI.

To enable creating this API, you must have at least the manage_api_key cluster privilege, Kibana User privilege with managing dev tools permissions.

Login into Kibana GUI.

Once Logon to the console, click on left menu panel to open Available Options for GUI.

3. After clicking on menu panel, select Dev Tools under Management Tab to create a new API Key.

4. To get a new API key, we need to craft request as given below and execute that in the console.

Find the below snapshot in which you may find generated query for elasticsearch v8.14.0 and its response.

Here, we have provided query code example and its expected response.
a. Query Example -

POST _security/api_key?pretty
{
  "name": "My_API_Name",
  "expiration": "365d",
  "role_descriptors": {
    "API-Role-Name": {
      "cluster": [ "all" ],
      "index": [
        {
          "names": [ "*logs-endpoint*", ".internal.alerts*", "Logs-elastic_agent.endpoints*" ],
          "privileges": [ "read" ]
        }
      ]
    }
  }
}

The query argument "expiration" has been optional for the API key being generated. f an expiration time is not specified, the API key will not expire.

b. Query Response -

{
"id" : "Unique id generated for this API key",
"name" : "My_API",
"expiration" : "Epoch Time value for key expiry",
"api_key" : "Generated API Key"
"encoded": "Combined Encoded output id and api_key values"
}

Now, provide us Elasticsearch Endpoint URL, id and api_key to complete integration.

LCP Configuration Parameters

Table 1-2: The Microsoft Azure Databricks event collector (API – 5081) properties to be configured by MDR are shown in the table.

Property	Default Value	Description

Property	Default Value	Description
URL	<ElasticEndpointURL>:9243	Elastic Endpoint URL along with port number where Default port number is 9243.
Id		id value generated from Dev Tools of Kibana GUI
APIKey		api_key value generated from Dev Tools of Kibana GUI
Index		Provide Elasticsearch Index Name. Below are all Possible Elastic Defend Indices Names - `.ds-logs-endpoint.alerts* .ds-logs-endpoint.events.file* .ds-logs-endpoint.events.library* .ds-logs-endpoint.events.network* .ds-logs-endpoint.events.process* .ds-logs-endpoint.events.registry* .ds-logs-endpoint.events.security* .ds-logs-endpoint.events.api*`

Onboarding Note - We must configure separate sensor thread for each of these indices.