Enterasys Security Information and Event Manager, Configuration Manual

Page: 120 / 426

Configuring DSMs
104 F5 N
ETWORKS
Step 7
You are now ready to configure the log sources and protocol in SIEM.
To configure SIEM to receive events from an F5 Networks BIG-IP ASM device:

From the Log Source Type drop-down list box, select the F5 Networks
BIG-IP ASM option
For more information on configuring log sources, see the Log Sources User Guide .
For more information on adding remote syslog sources, see your F5 Networks
BIG-IP ASM product documentation.
F5 Networks BIG-IP
APM
The SIEM F5 Networks BIG-IP Access Policy Manager (APM) DSM collects
access and authentication security events from a BIG-IP APM device using syslog.
Before receiving events in SIEM, you must configure your F5 Networks APM
device to forward syslog events to SIEM.
To configure syslog for F5 BIG-IP APM 10.x and above:
Step 1
Log in to the command line of your F5 BIG-IP device.
Step 2
Type the following command to add a single remote syslog server:
bigpipe syslog remote server {<Name> {host <IP Address>}}
Where:
<Name>
is the name of the F5 BIG-IP APM syslog source.
<IP Address>
is the IP address of SIEM.
For example:
bigpipe syslog remote server {BIGIP_APM {host 10.100.100.101}}
Step 3
Type the following to save the configuration changes:
bigpipe save
Step 4
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from an F5 Networks BIG-IP APM device:

From the Log Source Type drop-down list box, select F5 Networks BIG-IP
APM .
For more information on configuring log sources, see the Log Sources User Guide .
For more information on adding remote syslog sources, see your F5 Networks
BIG-IP APM product documentation.
F5 Networks
FirePass
The SIEM F5 Networks FirePass DSM collects system events from an F5 FirePass
SSL VPN device using syslog. By default, remote logging is disabled and must be
enabled in the F5 Networks FirePass device. Before receiving events in SIEM, you