Accenture MDR Quick Start Guide for Microsoft Azure VPN Gateway

This quick start guide will help Accenture MxDR customers configure Microsoft Azure VPN Gateway Event to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Microsoft Azure VPN Gateway
4 LCP Configuration parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in

Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
LCP	Storage Account/Event Hub	TCP / 443	Default port and protocol

Configuring Microsoft Azure VPN Gateway

Prerequisites :

An Azure subscription that you can sign in to.

A user who's a Global Administrator.

Azure Storage Account to store the logs or an Event Hub to stream the logs.

Reference URLs

How to create storage account?
Create a storage account - Azure Storage

How to configure Event Hub?
Azure Quickstart - Create an event hub using the Azure portal - Azure Event Hubs

Configuration Steps:

Use Azure Administrator user to configure the steps on the device.

Log in to the Azure portal, Go to Azure VPN Gateway
Under Settings, select Diagnostic settings

3. On the next Window, Provide appropriate in Name. and select all types of Logs Categories.

4. As per customer requirement, either you can store logs in Storage Account or stream the logs to Event Hub. MxDR supports log collection from both the options.

a) In Case Of Storing Logs In Blob Container

To store logs in Storage Account, select Archive to a storage account as shown in below screenshot and Choose an existing Subscription and Storage account.

Note: MxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies.

b) In Case of Streaming Logs To Event HUB

To stream logs to Event Hub, select Stream to an event hub as shown in below screenshot.
2.Select Subscription, event hub namespace , event hub name and event hub policy name created during Event Hub as part of pre-requisite.

5. Use below link to get credentials for Azure Storage and Azure Event HUB.

Accenture MDR Quick Start Guide to Get Credentials for Azure Storage and Azure Event HUB

LCP Configuration parameters

Table 1-2: The Microsoft Azure VPN Gateway Event (API - 5049) collector properties to be configured by MxDR are shown in table.

Property	Value If Using EventHub	Value If UsingStorage

Property	Value If Using EventHub	Value If UsingStorage
Logging Source	Select EventHub	Select Storage
eventHubConnectionString	Event hub connection string	N/A (keep blank)
consumerGroupName	Optional and used if consumer Group is other than default	N/A (keep blank)
Account Key	Access Key to access storage account	Access Key to access storage account
Blob Container	Storage blob Container name	Storage blob Container name. e.g. insights-logs-ikediagnosticlog insights-logs-tunneldiagnosticlog
Storage Account Name	Azure storage account name	Azure storage account name
Subscription	Set Eventhub name	Subscription ID that customer wants to be monitored
initialReadPolicy	N/A (keep default selection)	Select Beginning to start reading from beginning and End to start reading logs from the end

Note:

In case of EventHub logging source, storage Account Key/SAS Token, Blob Container, and Storage Account Name are required because the marker for the event hub gets stored in the storage account.

In case of Storage logging source, for each blob container created under storage account there should be separate sensor configuration created in the Log collection platform.