Product Integration Guides

• 1: Amazon CloudTrail
• 2: Amazon Virtual Private Cloud Flow Logs
• 3: Apache HTTP Server
• 4: Aruba Networks ClearPass
• 5: Azure Virtual Networks (NSG Flow)
• 6: Blackberry CylancePROTECT
• 7: Check Point Next-Generation Firewall
• 8: Cisco Identity Services Engine (ISE)
• 9: Cisco IOS Routers and Switches
• 10: Cisco Meraki MX Security Appliances
• 11: Cisco Secure Endpoint
• 12: Cisco Secure Firewall (ASA Appliances)
• 13: Cisco Secure Firewall (Firepower Threat Defense)
• 14: Cisco Umbrella
• 15: Citrix Netscaler (Formely Netscaler ADC)
• 16: Claroty Continuous Threat Detection (CTD)
• 17: Claroty xDome
• 18: Crowdstrike Falcon Insight
• 19: CyberArk Privileged Access Security (PAS)
• 20: ESET PROTECT
• 21: F5 BIG-IP LTM
• 22: Fortinet FortiAnalyzer
• 23: Fortinet FortiGate Next-Generation Firewall
• 24: Fortinet FortiWeb
• 25: GestioIP IPAM
• 26: Google Workspace
• 27: Infoblox DDI
• 28: Linux Authentication
• 29: Microsoft Azure Activity Logs
• 30: Microsoft Azure Application Gateway
• 31: Microsoft Azure Firewall
• 32: Microsoft Defender Advanced Hunting
• 33: Microsoft DHCP Server
• 34: Microsoft DNS Server
• 35: Microsoft Entra ID
• 36: Microsoft Graph (Security)
• 37: Microsoft IIS
• 38: Microsoft Office 365
• 39: Microsoft Windows Event Log
• 40: Okta Workforce Identity Cloud
• 41: Palo Alto Networks Cortex XDR Pro
• 42: Palo Alto Networks: Next-Generation Firewall
• 43: Palo Alto Networks: Panorama
• 44: PowerDNS Recursor
• 45: Proofpoint Targeted Attack Protection (TAP)
• 46: Samba AD
• 47: Sophos Central
• 48: Squid Cache
• 49: Trellix Endpoint Security (ENS)
• 50: Trellix Endpoint Security (HX)
• 51: Trend Micro Vision One
• 52: VMware Carbon Black Cloud Enterprise EDR
• 53: WatchGuard Firebox
• 54: Zscaler Internet Access (ZIA)

1 - Amazon CloudTrail

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Amazon Web Services (AWS) to send CloudTrail logs to S3 storage for ingestion to Samurai via a cloud collector.

Prerequisites

Ensure that an AWS cloud collector has been deployed via the Samurai MDR portal. 

• Guide available here

If you are planning to reuse an already deployed cloud collector, the information can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information:

• Account number
• Bucket name
• Region

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enabling CloudTrail Logs

Follow the AWS documentation guide:

• Creating a trail with the CloudTrail console

When following the vendor documentation, please perform the following adjustments:

• Enable for all accounts in my organization: Recommended to enable.
• Storage Location: Use existing S3 Bucket.
• Trail log bucket name: Select the S3 bucket which you setup during creation of the cloud collector.
• Prefix: Leave empty
• Log file SSE-KMS encryption: If enabled, extend the KMS Policy with:

{
    "Sid": "Allow NTTHS Samurai account to use this KMS key",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::600502389717:root"
    },
    "Action": [
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
    ],
    "Resource": "*"
}

• Event Type: At minimum Management events

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

2 - Amazon Virtual Private Cloud Flow Logs

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Amazon Web Services (AWS) to send Virtual Private Cloud (VPC) flow logs to S3 storage for ingestion to Samurai via a cloud collector

Prerequisites

Ensure that an AWS cloud collector has been deployed via the Samurai MDR portal. 

• Guide available here

If you are planning to reuse an already deployed cloud collector, the information can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information about the:

• Account number
• Bucket name
• Region

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enabling Amazon Virtual Private Cloud Flow Logs

Follow the AWS documentation guide:

• Create a flow log that publishes to Amazon S3

When following the vendor documentation, please perform the following adjustments:

• Filter: All
• Interval: 1 minute
• S3 Bucket ARN: Select the S3 bucket which you setup during creation of the cloud collector
• Log record format: Select AWS default format.
• Hive-compatible S3 prefixes: Unchecked
• Partition logs by time: Recommended to select Every 1 hour (60 mins)

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

3 - Apache HTTP Server

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Apache HTTP Server hosted on a Linux host to send access and error logs to a Samurai Local Collector deployed on your network by configuring rsyslog.

Connectivity Requirements

Configure Apache HTTP Server

Ensure that Apache HTTP Server is configured to log to syslog
Add or modify the ErrorLog and CustomLog directives in your Apache configuration file, normally located at /etc/apache2/apache2.conf:

ErrorLog "|/usr/bin/logger -p local6.error -t apache_error"CustomLog "|/usr/bin/logger -p local6.info -t apache_access" combined

Restart the Apache service to apply the configuration:

sudo systemctl restart apache2

Configure log forwarding with rsyslog

Follow the below steps to configure rsyslog to forward Error and Access events.

Rsyslog prerequisites

Ensure the following statement is included in the main rsyslog configuration file, normally located at /etc/rsyslog.conf:

$IncludeConfig /etc/rsyslog.d/*.conf

If no IncludeConfig statement exist for the /etc/rsyslog.d/ directory, append it to the end of rsyslog.conf.

Create /etc/rsyslog.d/ntt_apache.conf

Create /etc/rsyslog.d/ntt_apache.conf and insert the below configuration block, enter the Local Collector IP in the Target field.

template(name="apache-log" type="string" string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% apache_log %STRUCTURED-DATA% %msg%\n")if $programname == 'apache_error' then { action(  queue.type="LinkedList" queue.size="10000" type="omfwd" template="apache-log" Target="<Local Collector IP>" Port="514" Protocol="tcp" )}if $programname == 'apache_access' then {action(queue.type="LinkedList" queue.size="10000" type="omfwd" template="apache-log" Target="<Local Collector IP>" Port="514" Protocol="tcp")}

Validate and restart service

Confirm that rsyslog can parse the configuration without any errors by running:

rsyslogd -N1

Then restart the rsyslog service:

sudo systemctl restart rsyslog

The log messages will now be forwarded to the Samurai Local Collector.

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

4 - Aruba Networks ClearPass

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Aruba Networks ClearPass to send logs to a Samurai Local Collector deployed in your network.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Syslog Configuration

Follow the below steps in ClearPass Policy Manager to enable syslog output to the local collector.

1. Add a Syslog Target using the following parameters:

   Parameter	Value
   Host Address	IP of the Samurai Local Collector
   Protocol	TCP
   Server Port	514

2. Create Syslog Export Filters for each event type using the following parameters:

   Parameter	Value
   Export Template	Audit Records, Insight Logs and Session Logs
   Export Event Format Type	CEF
   Syslog Servers	Syslog target created in the above step

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

5 - Azure Virtual Networks (NSG Flow)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure a Network Security Group to send flow diagnostic logs to a Storage account for ingestion to Samurai via a cloud collector.

Prerequisites

Ensure that a cloud collector has been deployed via the Samurai MDR portal. 

• Guide available here

Take note of the name of the storage account created and which subscription it resides in. This will be used later when setting up the telemetry sources.

If you are planning to reuse an already deployed cloud collector, the information about the created storage account and subscription can be found via:

1. Navigate to the Samurai MDR portal.
2. On the left navigation pane, click Telemetry and select Collectors.
3. Click on the name of the desired collector.
4. Note down information about the:
   1. Subscription
   2. Storage account name

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enabling NSG flow logs

Follow the vendor documentation guide to enable NSG flow logs.

• Create a flow log - Via Azure Portal

When following the vendor documentation, please perform the following adjustments:

• Ensure when configuring the Storage Account setting that it’s referencing the storage account that was setup during the creation of the cloud collector.
• Ensure that version 2 for the Flow Logs Version is configured. This should be the default value when configuring via the Azure Portal.
• Ensure the retention period aligns with your storage policies however we recommend at minimum 7 days.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

6 - Blackberry CylancePROTECT

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure CylancePROTECT to send logs to a Samurai Local Collector deployed on your network. CylancePROTECT requires access to the Local Collector via syslog on port 514/TCP.

To complete this Integration you will need to:

1) From the Cylance Console

• Cylance syslog configuration

Cylance syslog configuration

Follow the steps outlined within the Blackberry documentation:

• Configure Cylance Endpoint Security to send events to a SIEM solution or syslog server

Use the following parameters when completing the steps:

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

7 - Check Point Next-Generation Firewall

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From Check Point Management Console:

• Configure Syslog Settings
• Create an NTT Account 
• Defining Trusted Clients
• Enable Packet Capture for IPS Protections
• Enable Packet Capture for IPS Core Protections

3) From the Samurai MDR portal:

• Complete the Check Point Next-Generation Firewall Integration

Connectivity Requirements

Configure Syslog Settings

• Log Exporter - Check Point Log Export

Once you have validated or updated your Check Point version follow the steps outlined in the Check Point documentation section Advanced Deployment:

• Log Exporter - Check Point Log Export - Advanced Deployment 

Use the following parameters when completing the Advanced Deployment :

cp_log_export add name NTT-LOGEXPORT target-server <SAMURAI Local Collector IP> target-port 514 protocol tcp format default read-mode semi-unified export-attachment-ids true

Create an NTT Account 

When you Complete the Check Point Next-Generation Firewall Integration in the Samurai MDR portal you can choose to use a username/password or API key for authentication. Note the authentication method when following the steps below.

Follow the Check Point documentation to create an NTT Account with password authentication:

• Creating an Administrator Account with Check Point Password Authentication

Follow the Check Point documentation to create an NTT Account with API key authentication:

• Creating an Administrator Account with API Key Authentication

Use the following parameters when completing the steps:

Defining Trusted Clients

In order to allow the NTT Account to access the Security Management Server via either username/password or API key it may be needed to configure Trusted Clients in the Check Point Management Console.

Follow the Check Point documentation when defining trusted clients:

• Defining Trusted Clients

General recommendation is to limit access to IPv4 Address and specifying the IP address of the Samurai Local Collector.

Enable Packet Capture for IPS Protections

Follow the Check Point documentation to enable packet capture for specific profiles:

• Activating Protections for a Specified Profile

Use the following parameters when completing the steps:

Enable Packet Capture for IPS Core Protections

Follow the Check Point documentation to enable packet packet for IPS Core Protections:

• Editing Core IPS Protections

Use the following parameters when completing the steps:

Complete the Check Point Next-Generation Firewall Integration

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations from the main menu

3. Click Create

4. Find and select Check Point Next-Generation Firewall

5. You will be presented with the Local Collector IP Address on the left of the screen

6. To configure Extended Telemetry Collection ensure it is enabled via the toggle

7. Enter the following information:

   • Name for the Integration - the name will appear in the Samurai MDR portal for you to easily reference
   • Description - optional but if completed will appear in the Samurai MDR portal for you to easily reference)
   • Devicename - an arbitrary name to identify the Check Point device
   • IP - IP address of host - this can include multiple separated by a comma (,)
   • API-key (optional) - if this is not specified will default to Username/Password
   • Domain (optional) - if the user is created in a specific domain, specify the domain
   • Username (optional) - enter a username if not using an API-Key
   • Password - specify password to use
   • Port - if you have changed the default port enter the port number, if not, we default to 443

8. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

8 - Cisco Identity Services Engine (ISE)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Cisco Identity Services Engine to send logs to a Samurai Local Collector deployed in your network.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Configure Syslog

Follow the steps outlined in Remote Logging Target Settings using the following parameters:

With the following logging categories enabled:

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

9 - Cisco IOS Routers and Switches

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Cisco IOS to send logs to a Samurai Local Collector deployed on your network. Your Cisco IOS device(s) require access to the Local Collector via syslog on port 514/UDP.

To complete this Integration you will need to:

1) From your Cisco IOS device

• Configure Log
• Test the logging configuration
• Configure ACL log

Configure Log

Use these instructions to configure Cisco IOS.

1. Log into the Cisco IOS device and specify the following commands:

1. en  
2. conf t  
3. no logging on  
4. archive
5. log config
6. logging enable
7. logging size 1000
8. notify syslog contenttype plaintext
9. hidekeys
10. exit
11. exit

12. logging host [Local Collector IP Address] where [Local Collector IP Address] is the IP address of the Samurai Local Collector deployed on your network.
13. logging trap 6
14. login on-failure log every 1
15. login on-success log every 1
16. logging origin-id hostname
17. logging source-interface [Interface Name] where [Interface Name] is the name of the interface that has access to the Samurai Local Collector.
18. no service sequence-numbers
19. no service timestamps
20. service timestamps log datetime localtime show-timezone
21. no logging message-counter syslog
22. no logging console
23. no logging monitor
24. logging buffered 16384 informational
25. logging on
26. end
27. wr mem  

Test the logging configuration

1. Execute the following commands to generate a %SYS-5-CONFIG_I log.

conf t
end

Configure ACL log

To configure logging of specific ACLs, add the option log to the end of the ACL to be monitored. For example:

access-list 101 deny tcp any host 192.168.35.0/24 25 log

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

10 - Cisco Meraki MX Security Appliances

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Cisco Meraki Security Appliances to send logs to a Samurai Local Collector deployed on your network. Cisco appliances require access to the Local Collector via syslog on port 514/UDP.

To complete this Integration you will need to:

1) From the Meraki Dashboard:

• Meraki syslog configuration

Meraki syslog configuration

Log in to the Meraki Dashboard and complete the following steps:

1. Click Network-wide.
2. Click General.
3. Click Add a syslog server.
4. In the Server IP field, enter the IP address of the Collector appliance deployed on your network.
5. Specify the Port as 514.
6. Select all the available Roles.
7. Click Save.

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

11 - Cisco Secure Endpoint

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) Within the Cisco Secure Endpoint web interface

• Determine API Endpoint
• Generate API Credentials

2) From Cisco Secure Malware Analytics

• Generate Secure Malware Analytics API Credentials

3) From the Samurai MDR portal:

• Complete the Cisco Secure Endpoint

Determine API Endpoint

The URL for API access Secure Endpoint depends on the region the instance is located, at the time of writing the following are available:

• api.amp.cisco.com
• api.apjc.amp.cisco.com
• api.consumer.amp.cisco.com
• api.eu.amp.cisco.com

The URL for API access to Secure Malware Analytics depends on the region the instance is located, at the time of writing the following are available:

• https://panacea.threatgrid.com
• https://panacea.threatgrid.eu

Generate API Credentials

Use the steps below to generate API credentials to allow a Samurai cloud collector to gather telemetry from Secure Endpoint:

1. Log in to your Cisco Secure Endpoint Instance.

2. Click Accounts > API Credentials

3. Click + New API Credential

4. Add a new API key with the following information:

   • In the Application name field, enter an appropriate name

   • From the Scope list, ensure Read & Write is selected

   • Click Create

5. The API credentials are displayed

6. Make a note of the 3rd Party API Client ID and API Key values

Generate Secure Malware Analytics API Credentials

Use these steps to generate API credentials to allow Samurai to gather telemetry from Secure Malware Analytics:

1. Log in to your Cisco Secure Malware Analytics Instance.

2. In the top-right click on your account name,then My Account

3. If no API key has been generated previously, click Generate API Key

4. Make a note of the API Key

Complete the Cisco Secure Endpoint Integration

You will need:

• Devicename (arbitrary name)
• API Endpoint (from Determine API Endpoint)
• API Client ID (from Generate API Credentials)
• API Key (from Generate API Credentials)
• Secure Malware Analytics API Key (from Generate Secure Malware Analytics API Credentials)

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations

3. Select Create

4. Locate and click Cisco Secure Endpoint

5. Click Next (we leverage a Samurai Cloud Collector)

6. Enter a Name of Integration

7. Enter a Description (Optional)

8. Enter your Devicename 

9. Enter your API Endpoint

10. Enter your API Client ID

11. Enter your API Key

12. Enter your Secure Malware Analytics Endpoint

13. Enter your Secure Malware Analytics API Key

14. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

12 - Cisco Secure Firewall (ASA Appliances)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Cisco Secure Firewall (ASA Appliances) to send logs to a Samurai Local Collector deployed on your network. Your Cisco appliances require access to the Local Collector via syslog on port 514/UDP.

To complete this Integration you will need to:

1) From your Cisco Firewall:

• Configure syslog

Configure syslog

Perform the following steps to configure syslog:

1. Log in to the Cisco ASA

2. From the command line specify the following commands to setup logging:

en
conf t
logging enable
logging timestamp
logging device-id
logging standby
logging trap debugging
logging queue 1024
logging host [interface name] [Local Collector IP Address]

where:

[interface name] is the name of the interface closest/routable to the Local Collector, and
[Local Collector IP Address ] is the IP address of the Samurai Local Collector deployed on your
network .

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

13 - Cisco Secure Firewall (Firepower Threat Defense)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Cisco Secure Firewall Threat Defense (FTD) (previously entitled Firepower Threat Defense) to send syslog to a Samurai Local Collector. 

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From Cisco Secure Firewall Management Center console:

• Send Security Event Syslog Messages from FTD Devices
• Enabling External Access to the Database
• Database User Creation

3) From the Samurai MDR portal

• Complete the Cisco Firepower Threat Defense Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Send Security Event Syslog Messages from FTD Devices

Follow the steps outlined within the Cisco documentation:

• Send Security Event Syslog Messages from FTD Devices

Cisco Documentation Step 1:

Use the following parameters:

Cisco Documentation Step 2:

Use the following parameters:

Cisco Documentation Step 3:

Complete the steps outlined.

Cisco Documentation Step 4:

Use the following parameters:

Cisco Documentation Step 5:

Complete the steps outlined.

Enabling External Access to the Database

Follow the steps outlined within the Cisco documentation:

• Enabling External Access to the Database

Use the following parameters when completing the steps:

Database User Creation

Follow the steps outlined within the Cisco documentation:

• Add an Internal User

Use the following parameters when completing the steps:

Complete the Cisco Secure Firewall (Firepower Threat Defense) Integration

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Click Create
4. Find and select Cisco Secure Firewall (Firepower Threat Defense)
5. Select the relevant Local Collector and click Next
6. You will be presented with the Local Collector IP Address 
7. Click Next
8. Complete the fields required including the Database Username and Password you created in Database user creation
9. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

14 - Cisco Umbrella

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Cisco Umbrella to send logs to S3 storage for ingestion to Samurai via a cloud collector.

Prerequisites

Ensure that an AWS cloud collector has been deployed via the Samurai MDR portal. 

• Guide available here

If you are planning to reuse an already deployed AWS cloud collector, the information can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information:

• Account number
• Bucket name
• Region

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enable Logging in the Cisco Umbrella Console

Follow the Enable Logging section (Steps 1-3) in the Cisco Umbrella documentation:

• Enable Logging

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

15 - Citrix Netscaler (Formely Netscaler ADC)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Citrix Netscaler to send logs to a Samurai Local Collector deployed on your network. Citrix Netscaler requires access to the Local Collector via syslog on port 514/UDP.

To complete this Integration you will need to:

1) From your Citrix Netscaler Appliance :

Follow the steps outlined within the Citrix documentation:

• Configuring Netscaler appliance for audit logging

Use the following parameters when completing the steps:

Table 1: Audit-log Action

Table 2: Audit-log Policy

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

16 - Claroty Continuous Threat Detection (CTD)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Claroty CTD to send logs to a Samurai Local Collector deployed on your network. Claroty CTD requires access to the Local Collector via syslog on port 514/TCP.

Prerequisites

The following integration will configure Rules for Baseline, Event and Alert Logs. A user account is also created for read-only API access to gather additional telemetry.

To complete this Integration you will need to:

1) From the Claroty Web management user interface

• Configure Save CAPs and Detect Known Threats

• Configure Rules for:

  • Baseline Rule
  • Events Rule
  • Alert Rule

• Create an account for API access

• Create a Group with permissions for the API access account

2) From the Samurai MDR portal

• Complete the Claroty Continuous Threat Detection (CTD) Integration

Configure Save CAPs and Detect Known Threats

1. Log in to Claroty’s web configuration dashboard.
2. Click the Configuration tab.
3. In the Networks area:
   • Select the checkbox to enable Save Caps
   • Select the checkbox to enable Detect Known Threats

Configuration of Rules

Baseline Rule

1. Log in to Claroty’s web configuration dashboard.

2. On the main menu on the left, click Configuration

3. Select Integrations > SIEM Syslog

4. Complete the following steps to add a rule to send baseline logs:

5. In the SIEM Syslog screen click on the “+” button

6. In the From list, click the relevant site(s)

7. The Add new Syslog screen will appear

8. Update the following fields:

   • Uncheck the LOCAL checkbox
   • From the MESSAGE CONTENTS list, click Baselines
   • From the MESSAGE FORMAT list, click CEF
   • Protocol - select all from the available list
   • Communication Type - select all available options
   • Access Type - select all available options
   • Server - enter in the IP address of your Samurai Local Collector
   • Port - enter 514
   • Protocol - TCP

9. Click Save

Events Rule

1. Log in to Claroty’s web configuration dashboard.

2. On the main menu on the left, click Configuration

3. Select Integrations > SIEM Syslog

4. Complete the following steps to add a rule to send Events logs:

5. In the SIEM Syslog screen click on the “+” button

6. In the From list, click the relevant site(s)

7. The Add new Syslog screen will appear

8. Update the following fields:

   • Uncheck the LOCAL checkbox
   • From the MESSAGE CONTENTS list, click Events
   • From the MESSAGE FORMAT list, click CEF
   • Below Select Filters for the corresponding alerts configure:
   • Category - select all available selections
   • Protocol - select all from the available list
   • Server - enter in the IP address of your Samurai Local Collector
   • Port - enter 514
   • Protocol - TCP

9. Click Save

Alert Rule

1. Log in to Claroty’s web configuration dashboard.

2. On the main menu on the left, click Configuration

3. Select Integrations > SIEM Syslog

4. Complete the following steps to add a rule to send Alerts logs:

5. In the SIEM Syslog screen click on the “+” button

6. In the From list, click the relevant site(s)

7. The Add new Syslog screen will appear

8. Update the following fields:

   • Uncheck the LOCAL checkbox
   • From the MESSAGE CONTENTS list, click Alerts
   • From the MESSAGE FORMAT list, click CEF
   • Category - select all available selections
   • Protocol - select all from the available list
   • Server - enter in the IP address of your Samurai Local Collector
   • Port - enter 514
   • Protocol - TCP

9. Click Save

Create an account for API access

1. Log in to Claroty’s web configuration dashboard.
2. On the main menu select Configuration and Users
3. In the User Management configuration screen, Click Add new users
4. Enter a Username
5. Enter a Full Name
6. Enter a Password
7. Repeat the Password
8. Click Add

Create a Group with permissions for the API access account

1. Log in to Claroty’s web configuration dashboard.
2. On the main menu select Configuration and Groups
3. In the Group Management configuration screen, Click Add new groups
4. Enter a Group Name
5. Select the user created in Create an account for API access from the Add User dropdown list
6. In the Systems Permissions area, Click Add permission
7. Select specific sites to which the permissions applies, or All Sites
8. From the All dropdown list, select relevant option
9. Set the appropriate permission level to Read
10. Click Save

Complete the Claroty Continuous Threat Detection (CTD) Integration

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations from the main menu

3. Click Create

4. Find and select Claroty Continuous Threat Detection (CTD)

5. Select the relevant Local Collector and click Next

6. You will be presented with the Local Collector IP Address on the left of the screen

7. To configure Extended Telemetry Collection ensure it is enabled via the toggle

8. Enter the following information:

   • Name for the Integration - the name will appear in the Samurai MDR portal for you to easily reference
   • Description - optional but if completed will appear in the Samurai MDR portal for you to easily reference)
   • Devicename - an arbitrary name to identify the Claroty CTD device
   • IP Address - the IP address of Claroty CTD
   • Username - enter the username you created in Create an account for API access
   • Password - enter the password you created in Create an account for API access
   • Port (Optional)- if you have changed the default port enter the port number, if not, we default to 5000

9. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

17 - Claroty xDome

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Claroty xDome to send logs to a Samurai Local Collector deployed in your network.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Configure Claroty Syslog

Follow the steps outlined in About Claroty Syslog (Claroty login is required) using the following parameters:

Table 2: Claroty Syslog Configuration

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

18 - Crowdstrike Falcon Insight

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) From the Crowdstrike Falcon Console:

• Submit a Support case with Crowdstrike
• Create credentials for basic authentication
• Create a new API client

2) From the Samurai MDR portal:

• Complete the Crowdstrike Falcon Insight Integration

3) Complete and send authorization form

Submit a support case with Crowdstrike

As our integration leverages the ‘Legacy API Credentials’ for the ‘Threat Graph API’ you must submit a support case directly with Crowdstrike for enablement. Please refer to the following Crowdstrike documentation.

Create credentials for basic authentication

To create credentials for basic authentication, perform the following steps:

1. Log in to the Crowdstrike Falcon Console

2. Click the Support and resources icon in the left menu pane.

3. Under Resources and tools select API Clients and Keys. The API Clients and Keys page is displayed.

4. Select the Legacy API Credentials tab.

5. Click Create Credentials

6. Copy the Username and Password. You will need the credentials to Complete the Crowdstrike Falcon Insight Integration

Figure 1: Credentials for basic authentication

Create a new API client

To create a new API client follow the steps below:

1. Log in to the Crowdstrike Falcon Console

2. Click the Support and resources icon in the left menu pane.

3. Under Resources and tools select API Clients and Keys. The API Clients and Keys page is displayed.

4. Click Create API client. The Create API client page appears.

5. Perform the following steps:

5.1 Specify NTT API Client in the CLIENT NAME field.

5.2 Specify API client for NTT in the DESCRIPTION field.

5.3 Under API SCOPES, perform the following steps:

5.4 Select the Read checkbox for:

• Detections
• Host
• Host groups
• Prevention policies
• Event Streams,
• User Management.

5.5 Select the Write checkbox for:

• Hosts.

6. Click Add.

Figure 2: Add new API client

7. Copy and record the values :

• CLIENT ID
• SECRET

Figure 3: Client ID and Secret

8. Take note of your Cloud location which is dervived from the Base URL as per the table below, you will need to specify the cloud location under Complete the Crowdstrike Falcon Insight Integration.

The table below outlines the Cloud location and Base URL:

9. Click DONE.

Complete the Crowdstrike Falcon Insight Integration

You will need:

• OAuth Client ID: (from Step 7 under Create a new API client)
• OAuth Secret: (from Step 7 under Create a new API client)
• Basic User: (from Step 6 under Create credentials for basic authentication)
• Basic Password: (from Step 6 under Create credentials for basic authentication)
• Cloud location: (from Step 8 under Create a new API client)

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations from the main menu

3. Select Create

4. Locate and click Crowdstrike Falcon Insight

5. Click Next (we leverage a Samurai Cloud Collector)

6. Enter a Name of Integration

7. Enter a Description (Optional)

8. Enter a Devicename

9. Enter your OAuth Client ID

10. Enter your OAuth Secret

11. Enter your Basic User

12. Enter your Basic Password

13. Select your Cloud Location (US-1 is default). 

14. Click Finish

Complete and send authorization form

Our SOC requires access to your Crowdstrike GUI in order to:

• Perform deeper investigations
• Access data not present in the APIs
• Perform remote isolation tasks

To ensure the SOC has access please complete this form Authorization Form for Access to Crowdstrike Falcon Host by MSP Personnel. Once you have completed, email the form to mssp@crowdstrike.com.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

19 - CyberArk Privileged Access Security (PAS)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure CyberArk PAS to send logs to a Samurai Local Collector deployed on your network. Your CyberArk PAS Vault deployment requires access to the Local Collector via syslog on port 514/UDP.

To complete this Integration you will need to:

1) From CyberArk Vault

• Configure Vault to forward syslog messages

Configure Vault to forward syslog messages

Follow the steps below, you may also wish to refer to CyberArk documentation.

1. Download ntt.xsl.

2. Log in to the (primary) CyberArk PAS Vault server as the administrator user

3. Navigate to the <CyberArk install folder>\Server\Syslog directory.

• By default, the subdirectory is: C:\Program Files (x86)\PrivateArk\Server\Syslog

4. Copy the ntt.xsl file into the directory.

5. Navigate to the <CyberArk install folder>\Server\ directory.

• By default, the subdirector is: C:\Program Files (x86)\PrivateArk\Server\

6. Copy the existing DBParm.ini file to DBParm.ini.bak file within the same directory (in case you need to rollback)

7. Edit the DBParm.ini file and make the following configuration changes:

For example:

SyslogServerIP=1.1.1.1,2.2.2.2

SyslogServerPort=514,6514

In the above example, server 1.1.1.1 would match with port 514, while server 2.2.2.2 would match with port 6514.

• For SyslogServerIP, enter the IP address of the Samurai Local Collector deployed on your network.
• For SyslogServerPort, enter 514
• For SyslogServerProtocol, enter TCP
• For SyslogTranslatorFile, enter Syslog\ntt.xsl
  This is the file mentioned in step 1 & 4
• For SyslogMessageCodeFilter, enter 0-999.
• For UseLegacySyslogFormat, enter No.

The changes to DBParm.ini should look like the following example:

[SYSLOG]SyslogServerIP=1.1.1.1SyslogServerPort=514SyslogServerProtocol=TCPSyslogTranslatorFile=Syslog\ntt.xslSyslogMessageCodeFilter=0-999UseLegacySyslogFormat=No

8. Save the file

9. Restart the Vault server

10. If applicable. perform the procedure on all Primary and Satellite Vaults.

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

20 - ESET PROTECT

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure ESET PROTECT On-Prem to send logs to a Samurai Local Collector deployed in your network.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Syslog Configuration

Follow the steps described in Export logs to Syslog using the following parameters:

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

21 - F5 BIG-IP LTM

Samurai [Local] Collector	Samurai [Cloud] Collector

Ensure correct network connectivity

You must ensure the following connectivity requirements are fulfilled:

Follow steps in F5 documentation

Perform the steps outlined in the vendor documentation to configure and implement a Request Logging profile:

• Configuring Request Logging

Perform the below settings adjustments under the relevant section. In case a setting property is not referenced below, simply use the default value.

Creating a pool with request logging to manage HTTP traffic

• IP address of logging server: Insert the IP address of the Samurai Local Collector.
• Service Port: 514

Creating a request logging profile

• HSL Protocol: TCP
• Custom Request Settings: BIGIP_LTM_WEB $BIGIP_HOSTNAME $VIRTUAL_NAME $NCSA_COMBINED

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

22 - Fortinet FortiAnalyzer

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From the FortiAnalyzer

• Create a restricted profile
• Configure log forwarding
• Create a new administrator

3) From your Fortigate devices (if using Fortigate devices)

• Enable FortiGate to send logs and PCAP to FortiAnalyzer

4) From your FortiWeb devices (if using Fortiweb devices)

• Configure FortiAnalyzer policies

5) From the Samurai MDR portal:

• Complete the FortiAnalyzer integration for each Fortigate

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Create a reduced restricted profile

Follow the steps outlined in the Fortinet documentation:

• Clone the restricted user system profile (V7.x)

Use the following parameters when completing the steps:

Configure log forwarding

Follow the steps outlined in the Fortinet documentation:

• Configuring log forwarding (V7.x)

Use the following required parameters when completing the steps:

Create a new administrator

Follow the steps outlined in the Fortinet documentation:

• Create a new administrator

Use the following parameters when completing the steps:

Enable FortiGate to send logs and PCAP to FortiAnalyzer

All FortiGate devices in scope must be connected to the FortiAnalyzer to send logs and PCAP.

Follow the steps outlined in the Fortinet documentation:

• Log settings and targets

Use the following required parameters when completing the steps:

Disk backed log buffer is recommended on Fortigates with an SSD disk. 

Follow the steps outlined in the Fortinet documentation:

• Log buffer on Fortigates with an SSD disk

Configure FortiAnalyzer policies for FortiWeb

Follow the steps in the section entitled ‘Configuring FortiAnalyzer policies’ outlined in the Fortinet FortiWeb documentation:

• Logging

Complete the Fortinet FortiAnalyzer Integration

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations from the main menu

3. Click Create

4. Find and select Fortinet FortiAnalyzer

5. Select the relevant Local Collector and click Next

6. Enter the following information

   • Name for the Integration - the name will appear in the Samurai MDR portal for you to easily reference
   • Description - optional but if completed will appear in the Samurai MDR portal for you to easily reference)
   • The Username and Password you created in Create a new administrator
   • Select Enable PCAP (only applicable to FortiGate devices) which was enabled in Enable FortiGate to send logs and PCAP to FortiAnalyzer
   • Hostname/IP - enter FortiAnalyzer hostname or IP address
   • Port (Optional) - if you have changed the default port enter the port number, if not, we default to 443
   • adom (optional) - if not specified we default to “root”

7. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

23 - Fortinet FortiGate Next-Generation Firewall

Samurai [Local] Collector	Samurai [Cloud] Collector

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From FortiGate Next-Generation Firewall console:

• Configure Syslog Forwarding Settings
• Configure Log Settings for Each Security Features
• Configure IPS Packet Logging
• Configure the Storage Settings
• Configure API Access Permission and Create API Key

3) If you have configured the options above, from the Samurai MDR portal:

• Complete the Fortinet FortiGate Next-Generation Firewall Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Configure Syslog Forwarding Settings

Execute the CLI commands outlined in the FortiGate Next Generation Firewall documentation.

• config log syslogd4 setting

config log syslogd4 setting
   set status enable  
   set server [IP address of your Samurai Collector]
   set mode udp
   set port 514
   unset source-ip
   set format default
end

• config log syslogd4 filter

config log syslogd4 filter
   set filter [see table 1]
   set filter-type include  
end

The following table shows the value indicating the send log for each security function.

Table 1: Security Features Logs To Be Sent

Configure Log Settings for Each Security Features

Execute the CLI commands outlined in the FortiGate Next Generation Firewall documentation.

• config firewall policy

config firewall policy
   edit [Policy ID]
       ...
   set logtraffic [utm or all]
   set logtraffic-start disable
       ...
   next
end  

• config antivirus profile

config antivirus profile   edit [Profile Name]      ...      set extended-log enable      ...   nextend

• config webfilter profile

config webfilter profile
   edit [Profile Name]
      ...
    set log-all-url disable
    set web-content-log enable
    set web-filter-activex-log enable
    set web-filter-command-block-log enable
    set web-filter-cookie-log enable
    set web-filter-applet-log enable
    set web-filter-jscript-log enable
    set web-filter-js-log enable
    set web-filter-vbs-log enable
    set web-filter-unknown-log enable
    set web-filter-refere-log enable
    set web-filter-cookie-removal-log enable
    set web-url-log enable
    set web-invalid-domain-log enable
    set web-ftgd-err-log enable
    set web-ftgd-quota-usage enable
    set extended-log enable
    set web-extended-all-action-log enable
   next  
end  

• config ips sensor

config ips sensor
   edit [Sensor Name]
      ...
     set extended-log enable
        config entries
           edit [ID]
           set location all
           set severity info low
           set protocol all
           set os all
           set application all
           set status [enable or default]
            (please refer to the table below)
           set log enable
           set log-packet disable
           set log-attack-context disable
           set action [pass or block or reset or default]
            (please refer to the table below)
            ...
           next
           edit [ID]
              set location all
              set severity medium high critical
          set protocol allset os all
          set application all
          set status [enable or default]
               (please refer to the table 2)
          set log enable
          set log-packet enable
          set log-attack-context disable
          set action [pass or block or reset or default]
              (please refer to the table 2)
              ...

Tip: Ensure evaluation order of IPS sensor entries so that the above settings apply properly.

Table 2: Matching Actions to Status

Configure IPS Packet Logging

Execute the CLI command outlined in the FortiGate Next Generation Firewall documentation.

• config ips settings

config ips settings   set packet-log-history 5   set packet-log-post-attack 10   set ips-packet-quota 0end

Configure the Storage Settings

After checking [HD logging space] with the following command, determine the size of [log-quota] with the following calculation:

[log-quota] = [Total HD logging space] / 2 

[log-quota] should be rounded down to the nearest thousand. In the following example, the [log-quota] is 88000.

diagnose sys logdisk usage
Total HD usage: 236286 MB/333 MB
Total HD logging space: 177214 MB
HD logging space usage for vdom "root": 106 MB/177214 MB  

Execute the CLI command outlined in the FortiGate Next Generation Firewall documentation.

• config log disk setting

config log disk setting
   set status enable  
   set ips-archive enable  
   set max-policy-packet-capture-size 100  
   set log-quota [calculated value above,for example here, 88000]  
   set maximum-log-age 5  
   set full-first-warning-threshold 75  
   set full-second-warning-threshold 90  
   set full-final-warning-threshold 95  
   set max-log-file-size 20  
   set roll-schedule daily  
   set diskfull overwrite
...  

Configure API Access Permission and Create API Key

Follow the steps outlined in the FortiGate Next Generation Firewall documentation.

• Administrator profiles 

Use the following parameters when completing the deployment:

Table 3: Administrator Profile

• Create new REST API admin

Use the following parameters when completing the deployment:

Table 4: REST API Admin

Complete the Fortinet FortiGate Next-Generation Firewall Integration

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations from the main menu

3. Click Create

4. Find and select Fortinet FortiGate Next-Generation Firewall

5. Select the relevant Local Collector and click Next

6. You will be presented with the Local Collector IP Address on the left of the screen

7. To configure Extended Telemetry Collection ensure it is enabled via the toggle

8. Enter the following information:

   • Name for the Integration - the name will appear in the Samurai MDR portal for you to easily reference
   • Description - optional but if completed will appear in the Samurai MDR portal for you to easily reference)
   • Devicename - an arbitrary name to identify the Fortinet device
   • API-Key - you generated under Create new Rest API Admin
   • Select Enable PCAP
   • Hostname/IP - hostname or IP address of Fortinet device to collect alerts from
   • Port - if you have changed the default port enter the port number, if not, we default to 443

9. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

24 - Fortinet FortiWeb

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Fortinet FortiWeb to send logs to a Samurai Local Collector deployed on your network. FortiWeb requires access to the Local Collector via syslog on port 514/UDP. 

If you have deployed a FortiAnalyzer, please refer to the Fortinet FortiAnalyzer integration guide.

1) From FortiWeb console:

• Configure syslog policy
• Configure trigger Policy
• Configure log destination
• Enable log types

Configure syslog policy

Follow the steps outlined in the section entitled ‘Configuring Syslog settings’ located within the Fortinet documentation:

• Logging

Use the parameters defined in the table below for each field:

Table 1 - Syslog settings

Configure trigger policy

Follow the steps outlined in the section entitled ‘Configuring triggers’ within the Fortinet documentation:

• Configuring triggers

Use the parameters defined in the table below for each field:

Table 2 - Trigger policy

Configure log destination

Follow the steps outlined in the section entitled ‘Configure log destinations’ within the Fortinet documentation:

• Configure log destinations

Use the parameter defined in the table below for each field:

Table 3 - Log destination

Enable log types

Follow the steps outlined within the Fortinet documentation:

• Enabling log types, packet payload retention, & resource shortage alerts

Use the parameter defined in the table below for each field:

Table 4 - Log types

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

25 - GestioIP IPAM

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure GestioIP asset information retrieval from a Samurai Local Collector deployed in your network.

Connectivity Requirements

Create GestioIP User

Follow the steps outlined in section 8.1.1.1 GestioIP Documentation to create a local user or section 8.1.2.2 if using LDAP. If using the authorization feature of GestioIP, ensure that the created user is added to the Read Only default group.

Complete the GestioIP IPAM Integration

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click GestioIP IPAM
5. Select a Samurai Local Collector
6. Enter the URL to your GestioIP instance
7. Enter User and Password as created in Creating GestioIP User
8. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

26 - Google Workspace

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to perform steps in both Google Workspace and the Samurai MDR portal.

Follow the steps below:

1. From Google Workspace

• Enable the Admin SDK API
• Create a service account
• Create credentials for the service account
• Delegate domain-wide authority to the service account

2. From the Samurai MDR portal

• Complete the Google Workspace Alert Center integration

Enable the Admin SDK API

Follow the Google API Console Help documentation:

• Enable and disable APIs

Ensure you login to the Google Console as a super administrator and use the following parameters when completing the steps:

Create a service account

Follow the steps outlined within the Google documentation:

• Create a service account

Use the following parameters when completing the steps:

Create credentials for the service account

Follow the steps outlined within the Google documentation:

• Create credentials for a service account

Delegate domain-wide authority to the service account

Follow the steps outlined within the Google documentation:

• Set up domain-wide delegation for a service account

Use the following parameters when completing the steps:

Complete the Google Workspace integration

You will need:

• JSON file you downloaded in Create credentials for the service account
• The admin account email used in Delegate domain-wide authority to the service account

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click Google Workspace 
5. Click Next (we leverage a Samurai Cloud Collector)
6. Enter a Name of Integration
7. Enter a Description (Optional)
8. Enter your Service Account JSON (copy and paste from the json file you downloaded)
9. Enter your Domain-Wide delegation account (the admin account email used for domain-wide delegation)
10. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

27 - Infoblox DDI

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure an on-premise Infoblox DDI device to send logs to a Samurai Local Collector deployed in your network.

To complete this Integration you will need to:

1. Ensure correct network connectivity
2. Perform Grid Configuration
3. Perform Data Management Configuration

Ensure correct network connectivity

You must ensure the following connectivity requirements are fulfilled:

Perform Grid Configuration

Perform the steps outlined in the vendor documentation to add an external syslog server:

• Specifying Syslog Server

Perform the below settings adjustments. In case a setting property is not referenced below, simply use the default value:

• Address: Insert the IP address of the Samurai Local Collector.
• Transport: Select TCP.
• Node ID: Select Host Name.
• Severity: Select Info.
• Logging Category: Select Send selected categories and then enable all logging categories.

Perform Data Management Configuration

Perform the steps outlined in the vendor documentation to configure DNS logging categories:

• Setting DNS Logging Categories

Perform the below settings adjustments. In case a setting property is not referenced below, simply use the default value:

• Logging Category: Select all the available categories.

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

28 - Linux Authentication

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Linux hosts to send authentication logs to a Samurai Local Collector deployed on your network by configuring rsyslog.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Configure log forwarding with rsyslog

Follow the below steps to configure rsyslog to forward authentication events.

Rsyslog prerequisites

Ensure the following statement is included in the main rsyslog configuration file, normally located at /etc/rsyslog.conf:

$IncludeConfig /etc/rsyslog.d/*.conf

If no IncludeConfig statement exist for the /etc/rsyslog.d/ directory, append it to the end of rsyslog.conf.

Create /etc/rsyslog.d/ntt_auth.conf

Create /etc/rsyslog.d/ntt_auth.conf and insert the below configuration block, enter the Local Collector IP in the Target field.

template(
  name = "linux-auth"
  type = "string"
  string = "<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% linux_auth %STRUCTURED-DATA% %msg%"
)

if ($syslogfacility-text == "auth" or $syslogfacility-text == "authpriv") then {
  action(
    queue.type="LinkedList"
    queue.size="10000"
    type="omfwd"
    template="linux-auth"
    Target="<Local Collector IP>"
    Port="514" Protocol="tcp")
}     

Validate and restart service

Confirm that rsyslog can parse the configuration without any errors by running:

rsyslogd -N1

Then restart the rsyslog service:

sudo systemctl restart rsyslog

The authentication messages will now be forwarded to the Samurai Local Collector.

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

29 - Microsoft Azure Activity Logs

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Microsoft Azure to send Activity Logs to a Storage account for ingestion to Samurai via a cloud collector.

Ensure that a cloud collector has been deployed via the Samurai MDR portal. 

• Guide available here

Take note of the name of the storage account created and which subscription it resides in. This will be used later when setting up the telemetry sources.

If you are planning to reuse an already deployed cloud collector, the information about the created storage account and subscription can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information about the:
   1. Subscription
   2. Storage account name

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enabling Azure Activity logs

Follow the vendor documentation guide to enable Microsoft Azure Activity logs.

• Create diagnostic settings in Azure Monitor

When following the vendor documentation, please perform the following adjustments:

• Select the following log categories

  • Administrative
  • Policy

• Ensure when configuring the Storage Account setting that it’s referencing the storage account that was setup during the creation of the cloud collector.

• Ensure the retention period aligns with your storage policies however we recommend at minimum 7 days.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

30 - Microsoft Azure Application Gateway

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes all steps required to configure Microsoft Azure Application Gateway to send logs to a Storage account for ingestion to Samurai via a cloud collector.

Ensure that a cloud collector has been deployed via the Samurai MDR portal.

• Guide available here

Take note of the name of the storage account created and which subscription it resides in. This will be used later when setting up the telemetry sources.

If you are planning to reuse an already deployed cloud collector, the information about the created storage account and subscription can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information about the:
   1. Subscription
   2. Storage account name

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Configure logging for Application Gateway

Follow the vendor documentation guide to enable Azure Application Gateway logs through the Azure Portal:

• Enable logging through the Azure portal

When following the vendor documentation, please perform the following adjustments:

• Select the following log categories

  • ApplicationGatewayAccessLogs
  • ApplicationGatewayFirewallLogs

• Ensure when configuring the Storage Account setting that it’s referencing the storage account that was setup during the creation of the cloud collector.

• Ensure the retention period aligns with your storage policies however we recommend at minimum 7 days.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

31 - Microsoft Azure Firewall

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure a Microsoft Azure Firewall to send logs to a Storage account for ingestion to Samurai via a cloud collector.

Prerequisites

Ensure that a cloud collector has been deployed via the Samurai MDR portal. 

• Guide available here

Take note of the name of the storage account created and which subscription it resides in. This will be used later when setting up the telemetry sources.

If you are planning to reuse an already deployed cloud collector, the information about the created storage account and subscription can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information about the:
   1. Subscription
   2. Storage account name

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enabling Azure Firewall logs

Follow the vendor documentation guide to enable Microsoft Azure Firewall logs.

• Enable Structured Logs

When following the vendor documentation, please perform the following adjustments:

• Select the following log categories

  • Network Rule
  • Application Rule
  • Nat Rule
  • Threat Intelligence
  • IDPS Signature
  • DNS query

• Ensure when configuring the Storage Account setting that it’s referencing the storage account that was setup during the creation of the cloud collector.

• Ensure the retention period aligns with your storage policies however we recommend at minimum 7 days.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

32 - Microsoft Defender Advanced Hunting

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Microsoft Defender to send Advanced Hunting Logs to a Storage account for ingestion to Samurai via a cloud collector.

Ensure that a cloud collector has been deployed via the Samurai MDR portal. 

• Guide available here

Take note of the name of the storage account created and which subscription it resides in. This will be used later when setting up the telemetry sources.

If you are planning to reuse an already deployed cloud collector, the information about the created storage account and subscription can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information about the:
   1. Subscription
   2. Storage account name

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enabling Defender Advanced Hunting Logs

Follow the vendor documentation guide to enable Advanced Hunting Logs data streaming to blob storage.

• Configure Microsoft Defender for Endpoint to stream Advanced Hunting events to your Storage account

• Ensure when configuring the Storage Account setting that it’s referencing the storage account that was setup during the creation of the cloud collector.

• Ensure the retention period aligns with your storage policies however we recommend at minimum 7 days.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

33 - Microsoft DHCP Server

Samurai [Local] Collector	Samurai [Cloud] Collector

Use this document to install and configure the Filebeat agent to send Microsoft DHCP Server logs to Samurai using the Samurai Local Collector deployed in your network.

To complete this Integration you will need to:

1. Ensure correct network connectivity
2. Download & Install Filebeat
3. Configure & Enable DHCP Server Audit Logging
4. Configure & Start Filebeat

Ensure correct network connectivity

You must ensure the following connectivity requirements are fulfilled:

Download & Install Filebeat

Perform the steps outlined in Step 1: Install Filebeat as per the vendor documentation.

Configure & Enable DHCP Server Audit Logging

Configure via Powershell

1. To view the DHCP Audit logging config, run the command Get-DhcpServerAuditLog.

   PS C:\> Get-DhcpServerAuditLogPath : C:\Windows\system32\dhcpEnable : TrueMaxMBFileSize : 70DiskCheckInterval : 50MinMBDiskSpace : 20
   

2. Verify that the flag Enabled is set to True.

   1. In case logging is not enabled, run the commend Set-DhcpServerAuditLog. Example command with arguments is presented below.

      PS C:\> Set-DhcpServerAuditLog -Enable $True -Path C:\dhcp
      

   2. The DHCP server needs to be restarted after logging has been enabled, run the following command to restart the service.

      PS C:\> Restart-Service DHCPServer
      

3. Note down the file path that has been configured, this will be used later in the section Configure & Start Filebeat.

Configure & Start Filebeat

1. Access the Filebeat installation folder and open and edit the file filebeat.yml.
2. Modify the below template by replacing the section IP_OF_LOCAL_COLLECTOR with the IP address of the Samurai Local Collector.
3. Modify the paths section of the template to use the path that was configured for the DHCP Server Audit log file location from Configure & Enable DHCP Server Audit Logging.

# ============================== Filebeat inputs ===============================
filebeat.inputs:
  - type: filestream
    id: win_dhcp
    enabled: true
    paths:
      - 'C:\Windows\System32\dhcp\Dhcp*'
    include_lines: ['^\d+,(\d+\/){2}\d+,.*$']
    tags: [win_dhcp_server]
#------------------------------ Logstash Output -------------------------------
output.logstash:
  hosts: ["IP_OF_LOCAL_COLLECTOR:5044"]

4. Replace the default configuration of filebeat.yml with the modified template and save the file.
5. Perform the steps outlined in Step 5: Start Filebeat as per the vendor documentation to start the service.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

34 - Microsoft DNS Server

Samurai [Local] Collector	Samurai [Cloud] Collector

Use this document to install and configure the Filebeat agent to send Microsoft DNS Server logs to Samurai using the Samurai Local Collector deployed in your network.
To complete this Integration you will need to:

1. Ensure correct network connectivity
2. Download & Install Filebeat
3. Configure & Enable Microsoft DNS Server Debug Logging
4. Configure & Start Filebeat

Ensure correct network connectivity

You must ensure the following connectivity requirements are fulfilled:

Download & Install Filebeat

Perform the steps outlined in Step 1: Install Filebeat as per the vendor documentation.

Configure & Enable Microsoft DNS Server Debug Logging

1. Follow the steps outlined in To select and enable debug logging options on the DNS server as per the vendor documentation.

2. Configure Packet direction & Packet Contents*.*

   1. Keep default configuration or follow the minimum requirement below.
   2. Minimum requirement is to enable logging for Outgoing Response.
      
      Figure 1 – Example of default configuration once “Log packets for debugging” has been enabled.

3. Configure an appropriate log location and name of the log file as well as a suitable Maximum Size (bytes) according to your system needs.

4. Note down the file path that has been configured, this will be used later in the section Configure & Start Filebeat.

Configure & Start Filebeat

1. Access the Filebeat installation folder and open and edit the file filebeat.yml.
2. Modify the below template by replacing the section IP_OF_LOCAL_COLLECTOR with the IP address of the Samurai Local Collector.
3. Modify the paths section of the template to use the path that was configured for the DNS Server debug log file location from Configure & Enable Microsoft DNS Server Debug Logging.

# ============================== Filebeat inputs ===============================
filebeat.inputs:
  - type: filestream
    id: win_dns_server
    enabled: true
    paths:
      - 'C:\dns_logs\*'
    include_lines: ['^\d{1,4}.\d{1,2}.\d{1,4}\s.*?$']
    tags: [win_dns_server]
# ------------------------------ Logstash Output -------------------------------
output.logstash:
  hosts: ["IP_OF_LOCAL_COLLECTOR:5044"]

4. Replace the default configuration of filebeat.yml with the modified template and save the file.
5. Perform the steps outlined in Step 5: Start Filebeat as per the vendor documentation to start the service.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

35 - Microsoft Entra ID

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure a Microsoft Entra ID to send logs to a Storage account for ingestion to Samurai via a cloud collector.

Prerequisites

Ensure that a cloud collector has been deployed via the Samurai MDR portal.

• Guide available here

Take note of the name of the storage account created and which subscription it resides in. This will be used later when setting up the telemetry sources.

If you are planning to reuse an already deployed cloud collector, the information about the created storage account and subscription can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information about the:
   1. Subscription
   2. Storage account name

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enabling Entra ID activity logs

Follow the vendor documentation guide to archive Microsoft Entra logs to an Azure storage account:

• How to archive Microsoft Entra activity logs to an Azure storage account

When following the vendor documentation, please perform the following adjustments:

• Select the following log categories

  • AuditLogs
  • SignInLogs
  • NonInteractiveUserSignInLogs
  • ServicePrincipalSignInLogs
  • ManagedIdentitiySignInLogs
  • ProvisioningLogs
  • ADFSSignInLogs

• Please note NonInteractiveUserSignInLogs may cause high log volume

• Ensure when configuring the Storage Account setting that it’s referencing the storage account that was setup during the creation of the cloud collector.

• Ensure the retention period aligns with your storage policies however we recommend at minimum 7 days.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

36 - Microsoft Graph (Security)

Samurai [Local] Collector	Samurai [Cloud] Collector

Supported Microsoft Security products

The Microsoft Graph Security API supports collection of alerts for multiple Microsoft Security products. An updated list can be found in the Microsoft documentation. Support for the following products has been validated by Samurai MDR:

• Microsoft Entra ID Protection
• Microsoft 365 Defender
• Microsoft Defender for Cloud Apps
• Microsoft Defender for Endpoint
• Microsoft Defender for Identity
• Microsoft Defender for Office 365
• Microsoft Defender for Cloud

Prerequisites

The user must have Global administrative access to the Microsoft 365 Defender and Microsoft Azure Portal.

Recommended Advanced Settings for Defender for Endpoint

If you are a customer with the Incident Response (IR) Retainer, in order to ensure an optimal service delivery and a quick turnaround from activation to remediation by the NTT Incident Response team the below features are recommended to be enabled in Defender for Endpoint:

• Live response
• Live response for servers
• Live response unsigned script execution

Follow the Microsoft documentation - Configure advanced features in Defender for Endpoint to enable the features.

To complete this Integration you will need to perform actions in both the Azure Portal and Samurai MDR portal:

1. Azure Portal

• Application Registration
• Enable MDR SOC access to Microsoft 365 Defender

2. From the Samurai MDR portal

• Complete the Microsoft Graph (Security) Integration

Application Registration

1. Follow the steps outlined within section entitled Register an application in the Microsoft Graph API documentation using the following parameters.

   Field Name	Parameter
   Supported account type	Accounts in this organizational directory only
   Redirect URL	Leave blank

2. Follow the steps outlined within section entitled Add a client secret in the Microsoft Graph API documentation.

3. Follow the steps outlined within section entitled Configure permissions for Microsoft Graph in the Microsoft Graph API documentation. Select the following permissions.
   SecurityAlert.Read.All

Enable the Samurai MDR SOC access to Microsoft 365 Defender

The steps outlined below are required for the Samurai SOC to perform remote isolation and further analysis through the Microsoft 365 Defender portal. You may also wish to refer to the Microsoft documentation - Granting managed security service provider (MSSP) access 

Prerequisites

Ensure role-based access control (RBAC) is enabled in your Microsoft Defender Security Center.

To enable RBAC in Microsoft Defender Security Center, navigate to Settings > Permissions > Roles and Turn on roles from a user account with Global Administrator or Security Administrator rights.

This feature also requires an Entra ID P2 plan for the Privileged Identity Management feature.

Create an Entra ID Group and assign role

To create an Entra ID group for NTT, perform the following steps:

1. Log in to Entra ID admin center

2. Navigate to Groups > All groups > New group

3. Select Security from the Group type list

4. Ensure that Microsoft Entra roles can be assigned to the group is set to Yes

After creating the group, follow the steps in Assign Microsoft Entra roles to groups to assign the Security Reader role to the newly created group.

Add NTT as Connected Organization

Perform the following steps to add NTT as a connected organization:

1. Navigate to Identity Governance
2. Click Connected organizations
3. Click Add connected organization
4. On the Basics tab*,* specify a Name and Description
5. On the Directory + domain tab, perform the following steps:
   1. Click Add directory + domain
   2. In the Select directories + domains field, search for security.ntt
      

Create a Resource Catalog

In the Entra ID portal under Identity Governance perform the following steps:

1. Navigate to the Catalogs tab
2. Click New catalog
3. Specify a Name and Descriptions, keep other values default
4. Click Create

Create an Access Package

An access package enables you to do a one-time set up of resources and policies that automatically administers access for the life of the access package.

To create a new access package, perform the following steps:

1. Navigate to Identity Governance

2. Click Access packages

3. Click New access package

4. Specify a Name and Description*,* select the Catalog created in the previous step

5. In the Resource roles tab, add the group created in previously and set Role to Member

6. In the Requests tab, ensure the following options are set (leave other settings as default):

   1. Set Users who can request access to For users not in your directory

   2. Under Select connected organizations, select NTT

   3. Set Require approval to Yes

   4. Under First Approver, add at least one fallback approver

   5. Set Enable new requests to Yes

7. In the Lifecycle tab, set Access Reviews to No

After creating the access package provide the My Access portal link to NTT.

Define your Sponsors

Sponsors are the people responsible for approving requests made by NTT staff. You may define internal and/or external sponsors.

Internal sponsors are select individuals from within your organization who can approve requests from NTT. External sponsors are select individuals from within NTT who can approve these on your behalf.

NTT recommends selecting external sponsors and obtaining a list of names during the MDR Onboarding. These names include managers and team leads who support the service.

Setting up sponsors is a time-consuming process as it requires approving access requests from NTT staff. Therefore, NTT recommends you define external sponsors to enable NTT to manage this process.

Initial NTT users will need to be approved by the selected Fallback approvers, after which they can be added as external sponsors.

To add external sponsors, select the Connected Organization and then Sponsors.

Complete the Microsoft Graph (Security) Integration

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click Microsoft Graph (Security)
5. Click Next (we leverage a Samurai Cloud Collector)
6. Enter Tenant ID, Application ID and Client Secret as created in Application Registration
7. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

37 - Microsoft IIS

Samurai [Local] Collector	Samurai [Cloud] Collector

Use this document to install and configure the Filebeat agent to send Microsoft IIS logs to Samurai using the Samurai Local Collector deployed in your network.

To complete this Integration you will need to:

1. Ensure correct network connectivity
2. Download & Install Filebeat
3. Configure & Enable Microsoft IIS Logging
4. Configure & Start Filebeat

Ensure correct network connectivity

You must ensure the following connectivity requirements are fulfilled:

Download & Install Filebeat

Perform the steps outlined in Step 1: Install Filebeat as per the vendor documentation.

Configure & Enable Microsoft IIS Logging

1. Follow the steps outlined below as per the vendor documentation for either per-site or per-server configuration that is best suited to your setup.

   1. Configure Logging at the Site Level.
   2. Configure Per-site Logging at the Server Level.

2. During step 4 in the vendor documentation, select W3C logging format.

   

3. Under “Select Fields…”, select all available fields:

   

4. Configure a suitable log file path for the logging files according to your system requirements.

5. During step 6 in the vendor documentation, configure Log File Rolloversettings and **Maximum file size (in bytes)**according to your system needs and requirements.

6. Note down the file path that has been configured, this will be used later in the section Configure & Start Filebeat.

Configure & Start Filebeat

1. Access the Filebeat installation folder and open and edit the file filebeat.yml.
2. Modify the below template by replacing the section IP_OF_LOCAL_COLLECTOR with the IP address of the Samurai Local Collector.
3. Modify the paths section of the template to use the path that was configured for the ISS Web Server log file location from Configure & Enable Microsoft IIS Logging.

# ============================== Filebeat inputs ===============================
filebeat.inputs:
  - type: filestream
    id: microsoft_iis
    enabled: true
    paths:
      - 'c:\inetpub\logs\LogFiles\*\*.log'
    include_lines: ['^[^#].*?$']
    tags: [microsoft_iis]

# ------------------------------ Logstash Output -------------------------------
output.logstash:
  hosts: ["IP_OF_LOCAL_COLLECTOR:5044"]

4. Replace the default configuration of filebeat.yml with the modified template and save the file.
5. Perform the steps outlined in Step 5: Start Filebeat as per the vendor documentation to start the service.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

38 - Microsoft Office 365

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) Within Microsoft 365:

• Ensure Microsoft Office 365 auditing is enabled
• Ensure Azure Exchange mailbox auditing is enabled (if monitoring Azure Exchange)
• Register application with Azure Active Directory
• Generate application secret key
• Specify permissions for the app

2) From the Samurai MDR portal:

• Complete the Office 365 Integration

Ensure Microsoft 365 auditing is enabled

Follow the steps outlined within the Office365 documentation to ensure audit logging is enabled:

• Turn auditing on or off

Verify that Azure Exchange Mailbox Auditing is Enabled

Azure Exchange Mailbox Auditing is enabled by default however verify this by following the Office365 documentation:

• Manage mailbox auditing

Register application with Azure Active Directory

Follow the steps outlined within the Office365 documentation:

• Register your application in Azure AD

Use the following parameters when completing the steps:

Table 1: App registration

Generate Application Secret Key

Follow the steps within the Office365 documentation:

• Generate a new key for your application

Use the following parameters when completing the steps:

Table 2: Secret key

Specify permissions for the app

Follow the steps within the Office365 documentation:

• Specify the permissions your app requires to access the Office 365 Management APIs

Use the following parameters when completing the steps:

Table 3: App permissions

Complete the Microsoft Office 365 Integration

You will need:

• Application (client) ID and Directory (tenant) ID created during Register application with Azure Active Directory
• Client Secret created during Generate Application Secret Key

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click Microsoft Office 365
5. Click Next (we leverage a Samurai Cloud Collector)
6. Enter a Name of Integration
7. Enter a Description (Optional)
8. Enter your Application (client) ID
9. Enter your Directory (tenant) ID
10. Enter your Secret Key (client Secret)
11. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

39 - Microsoft Windows Event Log

Samurai [Local] Collector	Samurai [Cloud] Collector

Use this document to install and configure the Winlogbeat agent to send Microsoft Windows Event Logs to Samurai using the Samurai Local Collector deployed in your network.

To complete this Integration you will need to:

1. Ensure correct network connectivity
2. Download & install Winlogbeat
3. Configure & Start Winlogbeat

Ensure correct network connectivity

You must ensure the following connectivity requirements are fulfilled:

Download & Install Winlogbeat

Perform the steps outlined in Step 1: Install Winlogbeat as per the vendor documentation.

Configure & Start Winlogbeat

1. Access the Winlogbeat installation folder and open and edit the file winlogbeat.yml.
2. Modify the below template by replacing the section IP_OF_LOCAL_COLLECTOR with the IP address of the Samurai Local Collector.

# ======================== Winlogbeat specific options =========================
winlogbeat.event_logs:
  - name: Application
  - name: System
  - name: Security
  - name: Microsoft-Windows-Sysmon/Operational
# ------------------------------ Logstash Output -------------------------------
output.logstash:
  hosts: ["IP_OF_LOCAL_COLLECTOR:5044"]

3. Replace the default configuration of winlogbeat.yml with the modified template and save the file.
4. Perform the steps outlined in Step 5: Start Winlogbeat as per the vendor documentation to start the service.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

40 - Okta Workforce Identity Cloud

Samurai [Local] Collector	Samurai [Cloud] Collector

Pre-requisites

• An Okta account with administrative privileges
• Your Okta Instance

From the Okta admin console

Create an OAuth service app integration

Follow the Okta documentation to:

• Create a service app integration

Generate a public/private key pair

Follow the Okta documentation to:

• Generate the JWK using the Admin Console

Use the following settings when completing:

• Client Authentication - Public / Private Key
• Public Key Configuration - Save Keys in Okta
• Select PEM to ensure the private keys appear in PEM format

Grant allowed scopes

Follow the Okta documentation to:

• Define the allowed scopes for the service app

Grant the following scope:

• okta.logs.read

Assign read-only administrator

Follow the Okta documentation to:

• Assign a read-only admin role to the service app

Complete the Okta Workforce Identity Cloud Integration

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click Okta Workforce Identity Cloud
5. Enter a Name of Integration
6. Enter a Description (Optional)
7. Enter your ClientID created under Create an OAuth 2.0 service app integration
8. Enter your Instance this refers to your Okta domain
9. Enter your PEM data by pasting your Private Key in PEM format created under Generate a public/private key pair
10. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

41 - Palo Alto Networks Cortex XDR Pro

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) From your Cortex XDR Gateway:

• Configure an API Key to allow us to collect telemetry

2) From the Samurai MDR portal:

• Complete the Palo Alto Cortex XDR Pro Integration

Configure an API Key to allow us to collect telemetry

Follow Steps 1-3 outlined within the Palo Alto Networks documentation:

• Get Started with Cortex XDR APIs

Use the following parameters when completing the steps:

Complete the Palo Alto Cortex XDR Pro Integration

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click Palo Alto Networks Cortex XDR Pro
5. Click Next (we leverage a Samurai Cloud Collector)
6. Enter a Name of Integration
7. Enter a Description (Optional)
8. Enter your Device Name
9. Enter the URL, API KeyID and API Key created in Configure an API Key to allow us to collect telemetry
10. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

42 - Palo Alto Networks: Next-Generation Firewall

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From your Palo Alto Networks Next Generation Firewall:

• Configure syslog to your Samurai Local Collector
• Create Log Forwarding Profiles
• Create URL Filtering Profile
• Create Filtering Profile Group
• Create Security Policy Rule
• Enable Packet Capture Profiles
• Enable API Access

4) From the Samurai MDR portal:

• Complete the Palo Alto Networks NG Firewall Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Configure syslog to your Samurai Local Collector

Follow the steps outlined within the Palo Alto Networks documentation to configure your firewall to send logs to your Samurai Local Collector:

If you do not have Panorama deployed:

• Configure Syslog Monitoring

If you have Panorama deployed please refer to Palo Alto Networks: Panorama (Be aware of steps based on your Panorama deployment mode)

Use the following parameters when completing the steps:

Create Log Forwarding Profiles

Follow the steps outlined within the Palo Alto Networks documentation:

• Configure Log Forwarding

You will need to configure Log forwarding profiles for each log type as per the table below:

Create URL Filtering Profile

Follow the steps outlined within the Palo Alto Networks documentation:

• Configure URL Filtering

Create Filtering Profile Group

Follow the steps outlined within the Palo Alto Networks documentation:

• Create a Security Profile Group

Use the following parameters when completing the steps:

Create Security Policy Rule

Follow the steps outlined within the Palo Alto Networks documentation:

• Create a Security Policy Rule

Use the following parameters in the Actions tab when completing the steps:

Enable Packet Capture Profiles

Follow the steps outlined within the Palo Alto Networks documentation:

• Take a Threat Packet Capture

You will need to enable Packet Capture for for each profile as tables below:

Anti Virus Profile

Anti-Spyware Profile

Vulnerability Protection Profile

Enable API Access

Follow the steps outlined within the Palo Alto Networks documentation:

• Enable API Access

Creating a new Admin Role Profile to be used specifically by the Samurai platform.

Under XML API ensure to disable all permissions except the following:

1. Log
2. Operation Requests
3. Export

Once complete you now need to get the API key to be used in the Samurai MDR portal. Follow the Palo Alto documentation:

• Get Your API Key

When following the steps be sure to use the username and password you created in the previous step. Once successful make a note of the <Key> string as you will need this later when you Complete the Palo Alto Networks NG Firewall Integration

Complete the Palo Alto Networks Next-Generation Firewall Integration

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations from the main menu

3. Click Create

4. Find and select Palo Alto Networks Next-Generation Firewall

5. Select the relevant Local Collector and click Next

6. You will be presented with the Local Collector IP Address on the left of the screen

7. To configure Extended Telemetry Collection ensure it is enabled via the toggle

8. Enter the following information

   • Name for the Integration - the name will appear in the Samurai MDR portal for you to easily reference
   • Description - optional but if completed will appear in the Samurai MDR portal for you to easily reference)
   • Physical device name - this name is used as the source for alerts for this integration
   • API-Key you captured in Enable API Access
   • Hostname/IP - hostname or IP address of Palo Alto device to collect alerts from

9. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

43 - Palo Alto Networks: Panorama

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From your Palo Alto Networks Panorama:

• Configure syslog to your Samurai Local Collector
• Enable API Access
• Obtain your Wildfire API key (if applicable)

4) From the Samurai MDR portal:

• Complete the Palo Alto Networks Panorama Integration

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Configure syslog to your Samurai Local Collector

Follow the steps outlined within the Palo Alto Networks documentation to configure your Panorama to send logs to your Samurai Local Collector:

• Configure Syslog Monitoring

Use the following parameters when completing the steps:

If you will not be using the Panorama Management interface you will need to configure an alternative ethernet interface to forward syslog by following the documentation from Step 5.

Enable API Access

Follow the steps outlined within the Palo Alto Networks documentation:

• Enable API Access

Creating a new Admin Role Profile to be used specifically by Samurai.

Under XML API ensure to disable all permissions except the following:

1. Log
2. Operation Requests
3. Export

Once complete you now need to get the API key to be used in the Samurai MDR portal. Follow the Palo Alto documentation:

• Get Your API Key

When following the steps be sure to use the username and password you created in the previous step. Once successful make a note of the <Key> string as you will need this later when you Complete the Palo Alto Networks Panorama Integration

Obtain your Wildfire API key

If you leverage Wildfire, follow the steps outlined in the Palo Alto documentation to obtain your Wildfire API key:

• Get your API key

Complete the Palo Alto Networks Panorama Integration

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations from the main menu

3. Click Create

4. Find and select Palo Alto Networks Next-Generation Firewall Panorama

5. Select the relevant Local Collector and click Next

6. You will be presented with the Local Collector IP Address on the left of the screen

7. To configure Extended Telemetry Collection ensure it is enabled via the toggle

8. Enter the following information

   • Name for the Integration - the name will appear in the application for you to easily reference
   • Description - optional but if completed will appear in the application for you to easily reference)
   • Manager name- this name is used as the source for alerts for this integration
   • API-Key you captured in Enable API Access
   • Wildfire API-key - to enable Wildfire telemetry collection include the key you captured in Obtain your Wildfire API key
   • Hostname/IP - hostname or IP address of Palo Alto device to collect alerts from

9. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

44 - PowerDNS Recursor

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure PowerDNS Recursor logs to a Samurai Local Collector deployed on your network by configuring rsyslog.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Configure PowerDNS

Ensure that Structured Logging is enabled and Quiet is disabled in the PowerDNS Recursor configuration file, normally located at /etc/powerdns/recursor.conf:

structured-logging=yes
quiet=no

Configure log forwarding with rsyslog

Follow the below steps to configure rsyslog to forward authentication events.

Rsyslog prerequisites

Ensure the following statement is included in the main rsyslog configuration file, normally located at /etc/rsyslog.conf:

$IncludeConfig /etc/rsyslog.d/*.conf

If no IncludeConfig statement exist for the /etc/rsyslog.d/ directory, append it to the end of rsyslog.conf.

Create /etc/rsyslog.d/ntt_powerdns.conf

Create /etc/rsyslog.d/ntt_powerdns.conf and insert the below configuration block, enter the Local Collector IP in the Target field.

template(
	name = "powerdns-recursor"
	type = "string"
	string = "<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% powerdns_recursor %STRUCTURED-DATA% %msg%"
)
if ($programname == "pdns-recursor") then {  
	action(
		queue.type="LinkedList" 
		queue.size="10000"
		type="omfwd"
		template="powerdns-recursor"
		Target="<Local Collector IP>"
		Port="514" 
		Protocol="tcp" 
	)
}

Validate and restart service

Confirm that rsyslog can parse the configuration without any errors by running:

rsyslogd -N1

Then restart the rsyslog service:

sudo systemctl restart rsyslog

The log messages will now be forwarded to the Samurai Local Collector.

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

45 - Proofpoint Targeted Attack Protection (TAP)

Samurai [Local] Collector	Samurai [Cloud] Collector

The guide outlined the steps required to configure Proofpoint Targeted Attack Protection (TAP) to facilitate log ingestion into the Samurai platform.

To complete this Integration you will need to:

2) From your TAP dashboard:

• Generate TAP Service Credentials

3) From the Samurai MDR portal:

• Complete the Proofpoint Targeted Attack Protection (TAP)

Generate TAP Service Credentials

• Follows the steps outlined within section entitled Generate TAP Service Credentials in the Proofpoint TAP documentation.

Complete the Proofpoint Targeted Attack Protection (TAP)

1. Login to your Samurai tenant

2. Click Telemetry and select Integrations from the main menu

3. Select Create

4. Locate and click Proofpoint Targeted Attack Protection

5. Click Next (we leverage a Samurai Cloud Collector)

6. Enter a Name of Integration

7. Enter a Description (Optional)

8. Enter a Devicename

8. Enter your Service Principle

9. Enter your Secret

10. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

46 - Samba AD

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Samba AD to send authentication logs to a Samurai Local Collector deployed on your network by configuring rsyslog.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Configure Samba AD logging

Ensure that Authentication Audit Logging in JSON format is configured in the smb.conf file.

[global]
log level = 1 auth_json_audit:3

Configure log forwarding with rsyslog

Follow the below steps to configure rsyslog to forward authentication events.

Rsyslog prerequisites

Ensure the following statement is included in the main rsyslog configuration file, normally located at /etc/rsyslog.conf:

$IncludeConfig /etc/rsyslog.d/*.conf

If no IncludeConfig statement exist for the /etc/rsyslog.d/ directory, append it to the end of rsyslog.conf.

Create /etc/rsyslog.d/ntt_smb_auth.conf

Create /etc/rsyslog.d/ntt_smb_auth.conf and insert the below configuration block, enter the Local Collector IP in the Target field.

template(
  name = "samba-auth"
  type = "string"
  string = "<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% samba_auth %STRUCTURED-DATA% %msg%"
)

if ($programname == "samba_auth") then {
  action(
    queue.type="LinkedList"
    queue.size="10000"
    type="omfwd"
    template="samba-auth"
    Target="<Local Collector IP>"
    Port="514"
    Protocol="tcp")
}

Validate and restart service

Confirm that rsyslog can parse the configuration without any errors by running:

rsyslogd -N1

Then restart the rsyslog service:

sudo systemctl restart rsyslog

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

47 - Sophos Central

Samurai [Local] Collector	Samurai [Cloud] Collector

Supported Products

Sophos Central can integrate with many Sophos and Third-Party products. The following products are supported through the Sophos Central integration:

• Sophos Intercept X

To complete this Integration you will need to:

1) Within Sophos Central Admin

• Create an API Token

2) From the Samurai MDR portal:

• Complete the Sophos Central Integration

Create an API Token

Follow steps outlined within the Sophos documentation:

• API Token Management - Sophos Central Admin

Complete the Sophos Central Integration

You will need:

• Client ID: (from Create an API Token)
• Client Secret: (from Create an API Token)

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click Sophos Central
5. Click Next (we leverage a Samurai Cloud Collector)
6. Enter a Name of Integration
7. Enter a Description (Optional)
8. Enter your Devicename
9. Enter your Client ID
10. Enter your Client Secret
11. Enter your Tenant ID (optional) - if not included we will identify from your credentials
12. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

48 - Squid Cache

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Squid Cache hosts to send logs to a Samurai Local Collector deployed on your network by configuring rsyslog.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Configure Squid

Ensure that access_log is configured to log in format combined to syslog in the squid.conf file.

access_log syslog:local0.info combined

Configure log forwarding with rsyslog

Follow the below steps to configure rsyslog to forward authentication events.

Rsyslog prerequisites

Ensure the following statement is included in the main rsyslog configuration file, normally located at /etc/rsyslog.conf:

$IncludeConfig /etc/rsyslog.d/*.conf

If no IncludeConfig statement exist for the /etc/rsyslog.d/ directory, append it to the end of rsyslog.conf.

Create /etc/rsyslog.d/ntt_squid.conf

Create /etc/rsyslog.d/ntt_squid.conf and insert the below configuration block, enter the Local Collector IP in the Target field.

template(
  name = "squid-access"
  type = "string"
  string = "<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% squid_access %STRUCTURED-DATA% %msg%"
)

if ($programname == "squid") then {
  action(
    queue.type="LinkedList"
    queue.size="10000"
    type="omfwd"
    template="squid-access"
    Target="<Local Collector IP>"
    Port="514"
    Protocol="tcp")
}     

Validate and restart service

Confirm that rsyslog can parse the configuration without any errors by running:

rsyslogd -N1

Then restart the rsyslog service:

sudo systemctl restart rsyslog

The authentication messages will now be forwarded to the Samurai Local Collector.

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

49 - Trellix Endpoint Security (ENS)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Trellix Endpoint Security (ENS) to send logs through a Trellix ePolicy Orchestrator (On-prem) to a Samurai Local Collector deployed in your network.

Connectivity Requirements

You must ensure the following connectivity requirements are available:

Table 1: Connectivity requirements

Syslog Configuration

Follow the Trellix Register syslog servers documentation using the following parameters:

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

50 - Trellix Endpoint Security (HX)

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) Ensure Connectivity Requirements are in place

• Connectivity Requirements

2) From the FireEye HX Console:

• Create Users
• Acquisition Setting
• Enable Auto Triage
• Data Acquisition Script Setting
• Configuration for Log Collection
• Polling Configuration

3) From the Samurai MDR portal:

• Complete the Trellix Endpoint Security (HX) Integration

Connectivity Requirements

Create Users

Perform the following steps:

• Login to the Endpoint Security Web UI with admin access
• Navigate to Admin > Appliance Settings
• Click User Accounts and specify the following information to create a new user account for NTT:

Verify the logins using the above accounts as you will need this information to Complete the Trellix Endpoint Security (HX) Integration

Acquisition Setting

Configure the Acquisition setting to enable triage file retrieval:

• Login to the Endpoint Security Web UI with admin access
• Navigate to Admin > Acquisition Settings
• Turn on File & Data Acquisition.
• Click Save.

Enable Auto Triage

Configure the auto triage setting to make triage files available in the HX instance:

• Login to the Endpoint Security Web UI with admin access
• Navigate to Admin > Triage Settings
• On the Automatic Triages settings page, toggle the Triage Settings switch to ON
• Click Save.

Data Acquisition Script Setting

Configure the Data Acquisition setting to enable event log retrieval:

• Login to the Endpoint Security Web UI with admin access
• Navigate to Admin > Data Acquisition Scripts
• Click Standard Investigative Details.
• On the Script Description page, click ACTIONS and select Edit
• Click Event Logs and then enable Security logs in the Windows event logs section.
• Click Save.

Configuration for Log Collection

Configure a syslog server (the Samurai Local Collector) using the CLI.

# show logging 
  Local logging level: notice 
	Override for class cef: none 
  Remote syslog default level: notice.

• Go to CLI Configuration mode and enter the following commands to configure syslog:

hostname > enable
hostname # configure terminal
hostname (config) # logging [IP Address of your Local Collector] trap none
hostname (config) # logging [IP Address of your Local Collector] trap overrride class cef 
priority info
hostname # logging [IP Address of your Local Collector] protocol tcp
hostname (config) # (config) # write memory

• Configure RFC-3339 Time Format

hostname > enable
hostname # configure terminal
hostname (config) # logging fields timestamp format rfc-3339
hostname (config) # (config) # write memory

Polling Configuration

This configuration is not mandatory but recommended to configure certain parameters in order to fully align with our service.

Perform the following steps:

• Login to the Endpoint Security Web UI with admin access
• Navigate to Admin > Policies
• From the Policies page, click Agent Default policy to edit the policy
• From the Edit Policy page, select Polling and overwrite the parameters highlighted in the table below

• Click Save to apply the configuration

Complete the Trellix Endpoint Security (HX) Integration

1. Login to the Samurai MDR portal

2. Click Telemetry and select Integrations from the main menu

3. Click Create

4. Find and select Trellix Endpoint Security (HX)

5. Select the intended Samurai Local Collector

6. You will be presented with the Local Collector IP Address on the left of the screen

7. To configure Extended Telemetry Collection ensure it is enabled via the toggle

8. Enter the following information:

   • Name for the Integration - the name will appear in the Samurai MDR portal for you to easily reference
   • Description (optional) - if completed will appear in the Samurai MDR portal for you to easily reference)
   • Devicename - an arbitrary name to identify FireEye HX
   • Username - enter a username (created under Create Users)
   • Password - specify password to use (created under Create Users)
   • Hostname / IP - IP address or hostname of the manager
   • Custom Port (optional)- if you have changed the default port enter the port number, if not, we default to 443

9. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

51 - Trend Micro Vision One

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) From the Trend Micro Vision One console

• Create an API user and token
• Determine your Trend Vision One region

2) From the Samurai MDR portal

• Complete the Trend Micro Vision One integration

Create an API user and token

Follow the steps outlined in the Trend Micro documentation:

• Configuring Accounts

When completing the steps be sure to:

• Ensure the user account has User Role: Analyst
• Access Level is API Only
• You generate and copy the Authentication Token for use when you Complete the Trend Micro Vision One Integration

Determine your Trend Vision One region

Review the Trend Micro documentation to determine your region:

• How to check Trend Vision One region and Data Center location

Complete the Trend Micro Vision One Integration

You will need:

• Regional Domain: (this corresponds to the region from Determine your Trend Vision One region)
• Authentication Token: (you obtained from Create an API user and token)

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Click Create
4. Click Next (we leverage a Samurai Cloud Collector)
5. Find and select Trend Micro Vision One
6. Enter the Authentication Token within the Access token field
7. Select the Regional Domain
8. Click on Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

52 - VMware Carbon Black Cloud Enterprise EDR

Samurai [Local] Collector	Samurai [Cloud] Collector

To complete this Integration you will need to:

1) Within the VMware Carbon Black Cloud web interface

• Determine environment
• Determine Org key for API Access
• API Access

2) From the Samurai MDR portal:

• Complete the Carbon Black Cloud Enterprise EDR Integration

Determine Environment

The URL for API access appears in the address bar in a browser as follows:

https://defense-<Cloud Instance ID>.conferdeploy.net

Determine Org Key for API Access

To determine your Org Key for API Access:

1. Login to your Carbon Black Cloud instance
2. Select Settings > API Access
3. The ORG KEY is shown on the screen.

API Access

Use these steps to configure a custom API access level:

1. Log in to your Carbon Black Cloud Instance with an account that has the Super Admin role.
2. Click Settings > API Access
3. Go to the Access Level-tab
4. Click Add Access Level
   1. In the Name field, enter Samurai-Access
   2. Enter a description
   3. Select the following permissions
      • org.alerts Read
      • org.watchlists Read
      • device Read
      • org.search.events Create, Read
   4. Click Save

Use these steps to enable API configuration to allow Samurai to gather telemetry:

1. Click Settings > API Access

2. Click +Add API Key

3. Add a new API key with the following information:

   • In the Name field, enter Samurai-MDR
   • From the Access Level type list, select Custom
   • From Custom Access Level list, select Samurai-Access
   • Click Save

4. The API credentials are displayed

5. Use the copy button to copy the Samurai-MDR API ID and API Secret Key. Paste the information to a file clearly indicating name, API ID, and API secret key.

Complete the VMware Carbon Black Cloud Enterprise EDR Integration

You will need:

• Environment: (the URL from Determine Environment e.g https://defense-<ENV>.conferdeploy.net)
• Organization Key: (from Determine Org Key for API Access)
• API ID: (from API Access)
• API Secret: (from API Access)

1. Login to the Samurai MDR portal
2. Click Telemetry and select Integrations from the main menu
3. Select Create
4. Locate and click Carbon Black Enterprise EDR
5. Click Next (we leverage a Samurai Cloud Collector)
6. Enter a Name of Integration
7. Enter a Description (Optional)
8. Enter your Environment
9. Enter your Organization Key
10. Enter your API ID
11. Enter your API Secret
12. Click Finish

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

53 - WatchGuard Firebox

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure WatchGuard Firebox to send logs to a Samurai Local Collector deployed on your network. The Firebox requires access to the Local Collector via syslog on port 514/UDP. 

1) From your WatchGuard Firebox:

• Adding Syslog Servers

Adding Syslog Servers

Follow the steps outlined in the following section of the WatchGuard documentation.

• Add Syslog Servers

Use the following parameters when completing the steps:

Table 1: Adding Syslog Servers

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.

54 - Zscaler Internet Access (ZIA)

Samurai [Local] Collector	Samurai [Cloud] Collector

Connectivity Requirements

You must ensure the following connectivity requirements are fulfilled:

Adding NSS Server

Follow the steps outlined in the ZIA documentation. If you use an existing one, skip this section.

• Adding NSS Server

Use the following parameters when completing the steps:

Adding NSS Feeds for Web Logs

Follow the steps outlined in the ZIA documentation.

• Adding NSS Feeds for Web Logs

Use the following parameters when completing the steps:

Adding NSS Feeds for Firewall Logs

Follow the steps outlined in the ZIA documentation.

• Adding NSS Feeds for Firewall Logs

Use the following parameters when completing the steps:

Adding NSS Feeds for DNS Logs

Follow the steps outlined in the ZIA documentation.

• Adding NSS Feeds for DNS Logs

Use the following parameters when completing the steps:

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the Samurai MDR portal as we auto detect the vendor and product. The only reason you need to use the Samurai MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.