Accenture MDR Quick Start Guide for Splunk® Enterprise™ for Windows® Events

This quick start guide will help Accenture MDR customers configure Splunk® Enterprise™ for Windows® to send logs to the Log collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Note: Please discuss with onboarding team if you have any technologies sending logs to LCP with same port and protocol

Configuring Splunk Enterprise for Windows Events

Note: 

• Splunk Heavy Forwarder sends indexed events to the LCP using syslog protocol, which uses RFC 5424. Splunk provides the parameters to set the maximum size of an event that can be transmitted over syslog. This functionality has been introduced in version 6.2; therefore, Microsoft Windows via Splunk Enterprise Syslog event collector will not be supporting previous releases over syslog.

• You need to configure Splunk Enterprise to send syslog messages to the LCP and also configure it to send only Windows-based logs to the LCP. Splunk indexes data from a number of different products, but Accenture Security MDR monitors only Windows events. So, the configuration should be such as to send only Windows container logs to the LCP. To accomplish this, a syslog output processor is required which is only a part of heavy forwarder (Splunk Enterprise).

• The file path given in the configuration steps is same in both Windows and Linux platform. You need to navigate to the Splunk installation root folder to configure the above mentioned file. These files (output.conf, transform.conf, and props.conf) can also be present under a different location, such as …\etc\system\default\..., but for given configuration to work, the file under the “local” folder needs to be changed.

 To configure Splunk to send the output using syslog, follow the steps below.

1. Navigate to the Splunk installation root folder: %Splunk_Installation_Path%\etc\system\local\outputs.conf. All the configuration changes must to be performed on the file in the local folder. 

2. Edit the outputs.conf file and do one of the configuration steps:

If you do not have existing syslog configuration, add the following configuration under syslog.

[syslog]

defaultGroup = SymantecMSS

[syslog:SymantecMSS]

server = LCP_IP_Address:Port_Number

type = tcp

priority = 13

timestampformat =  %b %d %H:%M:%S

maxEventSize = 16384

Note:

Server: Add LCP IP address and Port number

Type: Default is udp for Splunk, but MDR recommends TCP.

Priority: 13 is default value for auditing. Collector doesn't support if this field is set to NO_PRI.  Refer the URL for reference:  http://docs.splunk.com/Documentation/ Splunk/6.2.2/Admin/Outputsconf). 

MaxEventSize: MDR recommended value. All events exceeding this size will be truncated.

If you have an existing syslog configuration, add the following configuration after the existing group. 

For example, you may have the existing group name as "Sync1" and the Symantec MDR specified group is "SymantecMSS". So the settings need to be explicit and independent as below.

[syslog]

defaultGroup = Sync1,SymantecMSS

[syslog:Sync1]

server = customer_defined_server

Attribute2…=

Attribute3…=

# This ends settings for Sync1. Add, MSS defined settings here:

[syslog:SymantecMSS]

server = LCP_IP_Address:Port_Number

type = tcp

priority = 13

timestampformat =  %b %d %H:%M:%S

maxEventSize = 16384

Note:

• Server: Add LCP IP address and Port number

• Type: Default is udp for Splunk, but MDR recommends TCP.

• Priority: 13 is default value for auditing. Collector doesn't support if this field is set to NO_PRI.  Refer the URL for reference:  http://docs.splunk.com/Documentation/ Splunk/6.2.2/Admin/Outputsconf). 

• MaxEventSize: MDR recommended value. All events exceeding this size will be truncated.

 To configure Splunk to route only Windows logs to the LCP and filter others, follow the steps below.

1. Navigate to the Splunk installation root folder %Splunk_Installation_Path%\etc\system\local\props.conf. All the configuration changes must to be performed on the file in the local folder. 

2. Edit the props.conf file and add the below routing attribute at the bottom.

[source::WinEventLog:*]

TRANSFORMS-WinEventLog=SymantecMSSStanza - This can be any name.

3. Save and close the file.

4. Navigate to the Splunk installation root folder %Splunk_Installation_Path%\etc\system\local\transforms.conf. All the configuration changes must be performed on the file in the local folder.

5. Edit the transforms.conf file and add the below stanza at the bottom.

6. Edit $SPLUNK_HOME/etc/system/local/transforms.conf and set rules to match your props.conf stanza (i.e. SymantecMSSStanza):

[SymantecMSSStanza]

# This is stanza name which is defined in props.conf.

REGEX=.

DEST_KEY=_SYSLOG_ROUTING

FORMAT=SymantecMSS

# This is group name which defined in outputs.conf file

Note: All these file attributes are case-sensitive and has to be used as mentioned. Refer the following documentation for complete visibility on configuration: 

http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Outputsconf, http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf, and http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Transformsconf

 LCP Configuration Parameters

Table 1-2: The Splunk Enterprise for Windows event collector (Syslog - 3780) properties to be configured by MDR are shown in the table.

Sample Logs

Windows 2008

Jul 25 06:16:06 Test 07/25/2014 06:16:06 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4754 EventType=0 Type=

Information ComputerName=example.com TaskCategory=Security Group Management OpCode=Info RecordNumber=1901 Keywords=Audit Success Message=A security-enabled universal group was created.

Subject: Security ID: NT AUTHORITY\ANONYMOUS LOGON Account Name:ANONYMOUS LOGON Account Domain: TEST Logon ID: 0x3e6 Group:Security ID: SY\Enterprise Read-only Domain Controllers Group Name:

Enterprise Read-only Domain Controllers Group Domain: SY Attributes:SAM Account Name: Enterprise Read-only Domain Controllers SID History: -Additional Information: Privileges:

System Log

Oct 07 12:48:24 Test 10/07/2014 12:48:24 PM LogName=System SourceName=WinHttpAutoProxySvcEventCode=12503 EventType=4 Type=Information ComputerName=SYMANTEC-XITEST5

Category=0 CategoryString=none RecordNumber=89088 Message=The WinHTTPWeb Proxy Auto-Discovery Service has been idle for 15 minutes,it will be shut down.

Application Log

Jun 30 07:30:32 Test 06/30/2014 07:30:32 AM LogName=Application SourceName=ESENTEventCode=327 EventType=4 Type=Information ComputerName=WIN-LAGTESTN10J TaskCategory=General OpCode=Info

RecordNumber=396975Keywords=Classic Message=svchost(1444) The database engine detached a database(1, C:\Windows\system32\LogFiles\Sum\SystemIdentity.mdb).(Time=0 seconds) Internal Timing Sequence:

[1] 0.000, [2] 0.000,[3] 0.000, [4] 0.000,[5] 0.000, [6] 0.016, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000,[11] 0.000, [12] 0.000.Revived Cache: 0