This quick start guide will help Accenture MxDR customers configure Microsoft Azure VPN Gateway Event to allow log collection from the Log Collection Platform (LCP).
The document includes the following topics:
Supported Versions
A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in
Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents
Port Requirements
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
LCP | Storage Account/Event Hub | TCP / 443 | Default port and protocol |
Configuring Microsoft Azure VPN Gateway
Prerequisites :
An Azure subscription that you can sign in to.
A user who's a Global Administrator.
Azure Storage Account to store the logs or an Event Hub to stream the logs.
Reference URLs
How to create storage account?
Create a storage account - Azure Storage
How to configure Event Hub?
Azure Quickstart - Create an event hub using the Azure portal - Azure Event Hubs
Configuration Steps:
Use Azure Administrator user to configure the steps on the device.
Log in to the Azure portal, Go to Azure VPN Gateway
Under Settings, select Diagnostic settings
3. On the next Window, Provide appropriate in Name. and select all types of Logs Categories.
4. As per customer requirement, either you can store logs in Storage Account or stream the logs to Event Hub. MxDR supports log collection from both the options.
a) In Case Of Storing Logs In Blob Container
To store logs in Storage Account, select Archive to a storage account as shown in below screenshot and Choose an existing Subscription and Storage account.
Note: MxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies.
b) In Case of Streaming Logs To Event HUB
To stream logs to Event Hub, select Stream to an event hub as shown in below screenshot.
2.Select Subscription, event hub namespace , event hub name and event hub policy name created during Event Hub as part of pre-requisite.
5. Use below link to get credentials for Azure Storage and Azure Event HUB.
Accenture MDR Quick Start Guide to Get Credentials for Azure Storage and Azure Event HUB
LCP Configuration parameters
Table 1-2: The Microsoft Azure VPN Gateway Event (API - 5049) collector properties to be configured by MxDR are shown in table.
Property | Value If Using EventHub | Value If UsingStorage |
|---|---|---|
Logging Source | Select EventHub | Select Storage |
eventHubConnectionString | Event hub connection string | N/A (keep blank) |
consumerGroupName | Optional and used if consumer Group is other than default | N/A (keep blank) |
Account Key | Access Key to access storage account | Access Key to access storage account |
Blob Container | Storage blob Container name | Storage blob Container name. |
Storage Account Name | Azure storage account name | Azure storage account name |
Subscription | Set Eventhub name | Subscription ID that customer wants to be monitored |
initialReadPolicy | N/A (keep default selection) | Select Beginning to start reading from beginning and End to start reading logs from the end |
Note:
In case of EventHub logging source, storage Account Key/SAS Token, Blob Container, and Storage Account Name are required because the marker for the event hub gets stored in the storage account.
In case of Storage logging source, for each blob container created under storage account there should be separate sensor configuration created in the Log collection platform.