Managed Security Services - Event Collector Implementation, Configuration and Management

Transcription

1 Service Description Managed Security Services - Event Collector Implementation, Configuration and Management The services described herein are governed by the terms and conditions of the agreement specified in the Order Document for IBM Security Services ( Order Document ). If there is a conflict between the terms in the documents, the terms of the Order Document prevail over those of this document, and the terms of this document prevail over those of the agreement specified in the Order Document ("the Agreement"). Capitalized terms not otherwise defined in this document are defined in the Agreement or any other referenced document, and have the same meaning in this document as ascribed to them therein. This document describes the Services and incorporates by reference the following contract document(s). The terms and conditions contained in the incorporated document(s) are in addition to the terms and conditions contained herein. Contract Document(s) Document # Managed Security Services General Provisions I MSS Portal, Security Services Contacts and Security Reporting I Standard Services Deployment and Activation I Out-of-Band Access I The document(s) identified above are located at: From this security services contract documents portal, Client selects the applicable country to access the above documents. If any documents are not accessible, please request a copy from Client's IBM sales contact. 1.1 Event Collector Implementation, Configuration and Management During Event Collector Implementation, Configuration and Management, IBM will work with Client to deploy a new Event Collector Agent or begin management of an existing Event Collector Agent. Note: Implementation activities are performed one time during the performance of the services. If Client chooses to replace, upgrade, or move Client's Event Collector during the Services contract, IBM may require that such Event Collector be redeployed and reactivated (called Redeployment ). Such Redeployments will be provided at an additional charge as specified in an applicable Order Document. Implementation services are performed remotely, Client may contract separately for IBM to provide physical installation and configuration services. The Event Collector is a required device that Client provides. Such device is deployed at Client's location or designated Cloud hosting provider and managed and monitored by IBM MSS for an additional charge, as specified in the Order Document. IBM strongly encourages Out-of-Band ( OOB ) access to the Event Collector, as described in the section of this Services Description entitled Out-of-Band Access. The basic functions of the Event Collector are to: a. compile or otherwise combine the security events and log data; b. parse and normalize unknown, text-based system activity log formats for submission to the IBM MSS infrastructure; c. compress and encrypt the security events and log data; and d. transmit the security events and log data to the IBM MSS infrastructure. Core features of the Event Collector are to: e. perform local spooling by queuing the events locally when a connection to the IBM MSS infrastructure is not available; f. perform unidirectional log transmission. Event Collector communication is performed via outbound SSL/TCP-443 connections; I EN Page 1 of 5

2 g. perform message throttling. This limits the bandwidth from the Event Collector to the IBM MSS infrastructure based on selected Events per Second (EPS) as specified in the order document to preserve bandwidth; and h. provide transmit windows, if configured. The transmit windows enable/disable event transmission to the IBM MSS infrastructure during the timeframe specified Install and Configure the Event Collector a. provide live support, via phone and , and will assist Client with the location of applicable vendor documents detailing the installation and configuration procedures for the Event Collector operating system and IBM provided Event Collector software. Such support must be scheduled in advance to ensure availability of an IBM deployment specialist; b. provide Client with hardware specifications for the Event Collector platform; c. provide Client with Event Collector software and configuration settings; d. at Client's request, and for an additional charge specified in the Order Document, provide software installation services; e. for existing platforms: (1) assess existing hardware configurations to ensure they meet IBM s specification; and (2) identify required hardware upgrades to be provided and installed by Client. f. remotely configure the Event Collector to include registration of the Event Collector with the IBM MSS infrastructure and begin the deployment and management takeover process of the Event Collector; and g. confirm the IBM MSS infrastructure is receiving communication from the Event Collector. a. to provide the hardware for the Event Collector platform, based on IBM s recommended specifications and requirements; b. to maintain current licensing, and support and maintenance contracts for the hardware the Event Collector is installed upon; c. to install the IBM-provided Event Collector software on Client's provided hardware, under the guidance of IBM; d. to configure an external IP address and associated settings on the Event Collector; e. to provide IBM with the Event Collector IP address, hostname, machine platform, application version, and time zone; f. to be responsible for physical installation and cabling of the Event Collector; and g. to schedule live support with an IBM deployment specialist. 1.2 Device Support Module (DSM) Configuration The purpose of this activity is to provide Client with access to the DSM configuration guide, and the deployment of such DSMs to the Event Collector. a. provide Client with access to the DSM configuration guide; and b. provide live support during the configuration of the DSMs and Log Sources. I EN Page 2 of 5

3 a. to download the DSM configuration guide; b. to enable logging and auditing on Log Sources subscribing to the Services as described in the DSM configuration guide; c. to configure the DSM with appropriate settings (including: service level, site, platform, operating system, and time zone); d. to verify and confirm connectivity between the Log Source and the Event Collector; e. to log into the MSS Portal to confirm the Log Source is available and the Service is receiving logs within three business days of DSM installation and configuration; and f. acknowledges that Client is solely responsible for all DSM configuration tasks. 1.3 Windows Log Collection Implementation The purpose of this activity is to facilitate log collection from Windows devices using the WinCollect agent. a. provide Client with access to the WinCollect installation guide and the WinCollect agent software; b. provide Client with instructions on how to configure a WinCollect agent; and c. provide live support during the installation, distribution and configuration of the WinCollect agents. a. to download the WinCollect agents from the IBM provided link; b. to distribute and install the WinCollect agents to enable logging and auditing on Windows devices subscribing to the Services; c. to configure the WinCollect agents with appropriate configuration settings (including: headless mode, one to one or one to many configurations); d. to verify and confirm connectivity between the Windows device and the Event Collector; e. to log into the MSS Portal to confirm the Windows devices are available and the Service is receiving logs within three business days of WinCollect installation and configuration; and f. and acknowledges that Client is solely responsible for all WinCollect installation, configuration and maintenance tasks. 1.4 Event Collector Health Monitoring The purpose of this activity is to monitor the health and performance of the Event Collector. a. install monitoring software on the Event Collector; and b. analyze and respond to key metrics, which may include: (1) hard disk capacity; (2) CPU utilization; (3) memory utilization; (4) process availability; and (5) respond to alerts generated by the monitoring software. I EN Page 3 of 5

4 Client has no additional responsibilities required for this activity. 1.5 Event Collector Management The purpose of this activity is to provide ongoing management for the Event Collector. As determined by IBM, a. be the sole provider of software-level management for the Event Collector; b. maintain system status awareness; c. install new application and security content updates on the Event Collector, as they become available; d. install patches and software updates in order to improve performance, enable additional functionality, or resolve an application problem; e. declare a maintenance window in advance of Event Collector updates that may require platform downtime or Client's assistance to complete; and f. clearly state, within the maintenance window notification, the expected impacts of a scheduled maintenance on the Event Collector and any specific requirements needed from Client. a. to perform IBM-specified hardware upgrades to support the current software and firmware; b. to work with IBM to perform Event Collector updates (as required), and ensure Event Collectors are online during maintenance windows; c. to be responsible for all charges associated with hardware upgrades; d. to maintain current licensing, and support and maintenance contracts; e. to ensure appropriate consents are in place with Client's vendors to allow IBM to leverage existing support and maintenance contracts on Client's behalf. If such agreements are not in place, IBM will not be able to contact the vendor directly to resolve support issues; and f. and acknowledges that: (1) all updates are transmitted and applied via the Internet; (2) if vendor consents are not obtained or are revoked at any point during the contract period, Services and/or SLAs may be suspended by IBM; (3) noncompliance with IBM-required software or hardware upgrades may result in suspension of Services delivery and/or SLAs; and (4) devices offline or otherwise unavailable during software upgrades may become out of sync with IBM infrastructure, and may result in suspension of Services delivery and/or SLAs. 1.6 Notification The purpose of this activity is to notify Client if the Event Collector becomes unreachable through standard in-band means. a. notify Client if the Event Collector becomes unreachable through standard in-band means. Such notification will be via telephone using a predetermined notification procedure; b. begin investigation of problems related to the configuration or functionality of the Event Collector, following initiation of telephone notification and creation of an outage ticket in the MSS Portal; and c. display Event Collector health and outage tickets in the MSS Portal. I EN Page 4 of 5

5 a. to provide notification paths and contact information for Client's organization; b. to update IBM within three calendar days when Client's contact information changes; and c. to ensure an Authorized Security Contact or Designated Services Contact is available 24 hours/day, 7 days/week Troubleshooting The purpose of this activity is to perform research and investigation if the Event Collector does not perform as expected or a potential Event Collector health issue is identified. a. create a trouble ticket in the event of an Event Collector performance problem or potential Event Collector health issue; b. begin research and investigation of the documented issue; c. if the Event Collector is identified as the potential source of a network-related problem, examine the Event Collector configuration and functionality for potential issues; and d. display the Event Collector health and outage ticket in the MSS Portal. a. to participate in troubleshooting sessions with IBM (as required); b. to be responsible for providing all remote configuration and troubleshooting; and c. and acknowledges that if the Event Collector is eliminated as the source of a given problem, no further troubleshooting is required to be performed by IBM. I EN Page 5 of 5