Enterasys Security Information and Event Manager, Configuration Manual

Page: 103 / 426

Configuring DSMs
Enterasys Dragon 87
g
Click OK .
Step 5
Configure the Syslog notification rule:
a
Click the Notification Rules tab.
b
Click New .
c
In the name field, type
Enterasys Networks-RuleSys
.
d
Click OK .
e
In the Notification Rules panel, select the newly created Enterasys
Networks-RuleSys item.
f
Click the Syslog tab.
g
Click New .
The Syslog Editor is displayed.
h
Update the following values:
- Facility - Using the Facility drop-down list box, select a facility.
- Level - Using the Level drop-down list box, select notice .
- Message - Using the Type drop-down list box, select LEEF .
LEEF:Version=1.0|Vendor|Product|ProductVersion|eventID|devTime|
proto|src|sensor|dst|srcPort|dstPort|direction|eventData|
NOTE
The LEEF message format delineates between fields using a pipe delimiter
between each keyword.
i
Click OK .
Step 6
Verify that the notification events are logged as separate events:
a
Click the Global Options tab.
b
Click the Main tab.
c
Make sure that Concatenate Events is not selected.
Step 7
Configure the alarm information:
a
Click the Alarms tab.
b
Click New .
c
Type values for the parameters:
- Name - Type
Enterasys Networks-Alarm
.
- Type - Select Real Time .
- Event Group - Select Dragon-Events .
- Notification Rule - Select the Enterasys Networks-RuleSys check box.
d
Click OK .
e
Click Commit .
Step 8
Navigate to the Enterprise View.