This quick start guide will help Accenture MDR customers configure CyberArk Privileged Threat Analytics to send logs to the Log collection Platform (LCP).
The document includes the following topics:
Supported Versions
A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents
Port Requirements
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
CyberArk Privileged Threat Analytics | LCP | 514 (UDP) or 601 (TCP) | Default port |
Configuring CyberArk Privileged Threat Analytics
On Privileged Threat Analytics machine, open the default systemparm.properties file using DEFAULTPARM command.
Copy the line containing the syslog_outbound property, and exit the file.
Run a command - LOCALPARM to open the local systemparm.properties file.
Click 'i' to edit the file
Uncomment the syslog_outbound property in the file.
Paste the line you have copied on step-2 and edit the parameters.
Note: Refer the below table and example given
7. Save the configuration file and close it.
8. Restart Privileged Threat Analytics.
Use the following table as a guide:
Parameter | Value |
|---|---|
siem | HP ArcSight |
protocol | UDP/TCP |
port | 514/601 |
host | The Host/IP address of the LCP |
format | CEF |
Example:
syslog_outbound=[{"siem": "HP ArcSight ", "format": "CEF", "host": "LCP_MACHINE_ADDRESS", "port": 514, "protocol": "UDP"}]
LCP Configuration Parameters
Table 1-2: The CyberArk Privileged Threat Analytics event collector (Syslog - 3948) sensor properties to be configured by MDR are shown in the table.
Property | Default Value | Description |
Protocol | UDP | The default protocol for syslog. The collector can also accept logs in TCP. Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the Accenture Security MDR onboarding team. |
IP Address | Custom value | Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture Security MDR onboarding team. |
Signatures | |CyberArk|PTA| | MDR recommended signatures processed by the CyberArk PTA collector. |
Port Number | 514 | The default port number for syslog. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture Security MDR onboarding team if this is a requirement. |