Enterasys Security Information and Event Manager, Configuration Manual

Page: 133 / 426

Configuring DSMs
28 G
ENERIC
F
IREWALL
A SIEM generic firewall server DSM accepts events using syslog. SIEM records all
relevant events. Before you configure SIEM to integrate with generic firewall, you
must:
Step 1
Forward all firewall logs to your SIEM system.
For information on forwarding firewall logs from your generic firewall to SIEM, see
your firewall vendor documentation.
Step 2
Open the following file:
/opt/qradar/conf/genericFirewall.conf
Make sure you copy this file to systems hosting the Event Collector and the
Console.
Step 3
Restart the Tomcat server:
service tomcat restart
A message is displayed indicating that the Tomcat server has restarted.
Step 4
Enable or disable regular expressions in your patterns by setting the
regex_enabled property accordingly. By default, regular expressions are disabled.
For example:
regex_enabled=false
When you set the regex_enabled property to false, the system generates regular
expressions based on the tags you entered while attempting to retrieve the
corresponding data values from the logs.
When you set the regex_enabled property to true, you can define custom regex to
control patterns. These regex are directly applied to the logs and the first captured
group is returned. When defining custom regex patterns, you must adhere to regex
rules, as defined by the Java programming language. For more information, see
the following website: http://download.oracle.com/javase/tutorial/essential/regex/
To integrate a generic firewall with SIEM, make sure you specify the classes
directly instead of using the predefined classes. For example, the digit class
(/\d/)
becomes
/[0-9]/
. Also, instead of using numeric qualifiers, re-write the
expression to use the primitive qualifiers
(/?/,/*/ and /+/)
.
Step 5
Review the file to determine a pattern for accepted packets.