Accenture MDR Quick Start Guide for Splunk® Enterprise™ for Windows® Events

This quick start guide will help Accenture MDR customers configure Splunk® Enterprise™ for Windows® to send logs to the Log collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Note: Please discuss with onboarding team if you have any technologies sending logs to LCP with same port and protocol

Configuring Splunk Enterprise for Windows Events

Note: 

• Splunk Heavy Forwarder sends indexed events to the LCP using syslog protocol, which uses RFC 5424. Splunk provides the parameters to set the maximum size of an event that can be transmitted over syslog. This functionality has been introduced in version 6.2; therefore, Microsoft Windows via Splunk Enterprise Syslog event collector will not be supporting previous releases over syslog.

• You need to configure Splunk Enterprise to send syslog messages to the LCP and also configure it to send only Windows-based logs to the LCP. Splunk indexes data from a number of different products, but Accenture Security MDR monitors only Windows events. So, the configuration should be such as to send only Windows container logs to the LCP. To accomplish this, a syslog output processor is required which is only a part of heavy forwarder (Splunk Enterprise).

• The file path given in the configuration steps is same in both Windows and Linux platform. You need to navigate to the Splunk installation root folder to configure the above mentioned file. These files (output.conf, transform.conf, and props.conf) can also be present under a different location, such as …\etc\system\default\..., but for given configuration to work, the file under the “local” folder needs to be changed.

 To configure Splunk to send the output using syslog, follow the steps below.

1. Navigate to the Splunk installation root folder: %Splunk_Installation_Path%\etc\system\local\outputs.conf. All the configuration changes must to be performed on the file in the local folder. 

2. Edit the outputs.conf file and do one of the configuration steps:

Note:

Server: Add LCP IP address and Port number

Type: Default is udp for Splunk, but MDR recommends TCP.

Priority: 13 is default value for auditing. Collector doesn't support if this field is set to NO_PRI.  Refer the URL for reference:  http://docs.splunk.com/Documentation/ Splunk/6.2.2/Admin/Outputsconf). 

MaxEventSize: MDR recommended value. All events exceeding this size will be truncated.

For example, you may have the existing group name as "Sync1" and the Symantec MDR specified group is "SymantecMSS". So the settings need to be explicit and independent as below.

Note:

• Server: Add LCP IP address and Port number

• Type: Default is udp for Splunk, but MDR recommends TCP.

• Priority: 13 is default value for auditing. Collector doesn't support if this field is set to NO_PRI.  Refer the URL for reference:  http://docs.splunk.com/Documentation/ Splunk/6.2.2/Admin/Outputsconf). 

• MaxEventSize: MDR recommended value. All events exceeding this size will be truncated.

 To configure Splunk to route only Windows logs to the LCP and filter others, follow the steps below.

1. Navigate to the Splunk installation root folder %Splunk_Installation_Path%\etc\system\local\props.conf. All the configuration changes must to be performed on the file in the local folder. 

2. Edit the props.conf file and add the below routing attribute at the bottom.

3. Save and close the file.

4. Navigate to the Splunk installation root folder %Splunk_Installation_Path%\etc\system\local\transforms.conf. All the configuration changes must be performed on the file in the local folder.

5. Edit the transforms.conf file and add the below stanza at the bottom.

6. Edit $SPLUNK_HOME/etc/system/local/transforms.conf and set rules to match your props.conf stanza (i.e. SymantecMSSStanza):

Note: All these file attributes are case-sensitive and has to be used as mentioned. Refer the following documentation for complete visibility on configuration: 

http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Outputsconf, http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf, and http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Transformsconf

 LCP Configuration Parameters

Table 1-2: The Splunk Enterprise for Windows event collector (Syslog - 3780) properties to be configured by MDR are shown in the table.