Enterasys Security Information and Event Manager, Configuration Manual

Page: 123 / 426

Configuring DSMs
23 F
AIR
W
ARNING
A SIEM Fair Warning DSM retrieves event files from a remote source using the log
file protocol source. SIEM records event categories from the Fair Warning log files
about user activity related to patient privacy and security threats to medical
records. Your system must be running the latest version of log file protocol to
integrate with a Fair Warning device.
When configuring your Fair Warning device to use the log file protocol, make sure
the hostname or IP address configured in the Fair Warning system is the same as
configured in the Remote Host parameter in the Log File Protocol configuration.
You are now ready to configure the log source and protocol in SIEM.
To configure SIEM to receive events from a Fair Warning device:
Step 1
Select the Fair Warning option from the Log Source Type drop-down list box.
Step 2
Select the Log File option from the Protocol Configuration drop-down list box.
Step 3
Select Fair Warning as the Event Generator used to process the web content
filter log files.
Step 4
The FTP file pattern must use a regular expression that matches the log files
generated by the Fair Warning system.
For more information on configuring devices, see the Log Sources User Guide . For
more information on configuring Fair Warning, consult your vendor documentation.