Accenture MDR Quick Start Guide for MariaDB Event Collector

This quick start guide will help Accenture MDR customers configure MariaDB Event Collector to send logs to the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Destination Port	Description
MariaDB Server	LCP	10014 (Secure TCP)	Default port

Configuring MariaDB Event Collector

The below steps are validated on following Linux distribution - Ubuntu 24.04.1 LTS.

Pre-requisites

Ensure MariaDB Server is installed and running in the machine.
Ensure that mariadb server_audit plugin library must be located in the mariadb plugin directory. This library can be found named as the server_audit.so or server_audit.dll as shared library in MariaDB packages directory with default installation.

Install and Configure MariaDB Server Audit Plugin

Login into CLI with root or similar privileges.
Add following configuration in the various config blocks of mariadb configuration file /etc/mysql/mariadb.conf.d/50-server.cnf to enable logging using Server Audit Plugin.
1. Under [server] block add following lines:
```
[server]
plugin_load_add = server_audit
server_audit_logging=ON
```
2. Under [mysqld] block add following lines -
```
[mysqld]
server_audit_events=connect,query,table
server_audit_output_type=file
```
3. Optional Step - If customer wishes to implement log file rotation then it can be done by adding following lines under [mysqld] block.
```
server_audit_file_rotate_now=ON
server_audit_file_rotate_size=1000000
server_audit_file_rotations=5
```
Restart mariadb service.
```
systemctl restart mariadb.service
```

After restarting the mariadb service, it should start logging in the file.
If default settings are implimented then logs should be written under default directory path /var/lib/mysql/server_audit.log

NxLog Configuration

Contact MxDR on-boarding engineer to get CyberHub certificate.

Download and install the NXLog Linux agent from the following location: https://nxlog.co/downloads/nxlog-ce#nxlog-community-edition
Stop the NxLog service.
Rename the attached file to "nxlog.conf" and copy into "/etc/" folder.
If MariaDB is configured with custom audit log path, update the File directive on line 25 with the correct audit log file path. By default, it is set to /var/lib/mysql/server_audit.log in the provided NXLog configuration.
Replace the placeholder <CyberHub IP> with the actual CyberHub IP in the nxlog.conf file.
Copy the certificate which you obtained from MxDR team on Linux machine where nxlog agent is installed and mention the cert path in “nxlog.conf” against "CAFile" on line number 34.
Now, start the NxLog service.
NxLog agent logs will be available at location "/var/log/nxlog.log".
The log flow should work, and you can check it using tcpdump with the command "tcpdump -AA port 10014".

Logs does not contain time zone information so it is recommended sending logs in UTC.

LCP Configuration Parameters

Table 1-2: The MariaDB event collector (Generic- 4039) properties to be configured by MDR are shown in the table.

Property	Default Value	Description
Protocol	SECURE_TCP	Default protocol for Generic TCP Sensor.
Host Names	*	Specify the IP addresses or host names. Possible values: IP, hostname, or '*' .
Signatures		Specify the list of signatures (comma-separated list of strings) that are used to filter the incoming syslog
Enable Signatures	False Checkbox is checked by default.	Boolean property (represented by a checkbox in UI) that allows you to disable the signature filtering.
Port Number	10014	Default port. Provide port which you have configured in the device configuration.