Enterasys Security Information and Event Manager, Configuration Manual

Page: 119 / 426

Configuring DSMs
F5 Networks BIG-IP ASM 103
F5 Networks BIG-IP
ASM
The SIEM F5 Networks BIG-IP Application Security Manager (ASM) DSM collects
web application security events from a BIG-IP ASM device using syslog. Before
receiving events in SIEM, you must configure your F5 Networks ASM device with a
logging profile to forward application events to SIEM.
To configure a logging profile:
Step 1
Log in to the F5 Networks BIG-IP ASM device user interface.
Step 2
In the navigation pane, select Application Security > Options .
Step 3
Click Logging Profiles .
The Logging Profiles is displayed.
Step 4
Click Create .
The Create New Logging Profile is displayed.
Step 5
From the Configuration drop-down list box, select Advanced .
Advanced configuration options are displayed.
Step 6
Configure the following parameters:
a
Type a Profile Name.
For example:
SIEM
.
b
Optional. Type a Profile Description.
NOTE
If you do not want data logged locally as well as remotely, you must clear the
Local Storage check box.
c
Select the Remote Storage check box.
d
From the Type drop-down list box, select Reporting Server .
e
From the Protocol drop-down list box, select TCP .
f
Configure the Server Addresses fields:
- IP address - Type the IP address of the SIEM Console.
- Port - Type a port value of 514.
g
Select the Guarantee Logging check box.
NOTE
Enabling the Guarantee Logging option ensures the system log requests continue
for the web application when the logging utility is competing for system resources.
Enabling the Guarantee Logging option may slow access to the associated web
application.
h
Select the Report Detected Anomalies check box, to allow the system to log
details.
i
Click Create .
The display refreshes with the new logging profile.