Enterasys Security Information and Event Manager, Configuration Manual

Page: 157 / 426

Configuring DSMs
IBM RACF 141
Step 3
Select Services .
The Service Configuration page is displayed.
Step 4
Click the SNMP tab.
Step 5
Select SNMP Traps Enabled .
Step 6
In the Trap Receiver field, type the IP address of your SIEM system you wish to
monitor incoming SNMP traps.
Step 7
In the Trap Community field, type the appropriate community name.
Step 8
From the Trap Version list, select the trap version.
Step 9
Click Save Changes .
Step 10
You are now ready to configure SIEM to receive SNMP traps.
To configure SIEM to receive events from an ISS Proventia device:

From the Log Source Type drop-down list box, select IBM Proventia
Network Intrusion Prevention System (IPS) .
For information on configuring SNMP in the SIEM, see the Log Sources User
Guide .
For more information about your ISS Proventia device, see your vendor
documentation.
IBM RACF
The IBM Resource Access Control Facility (RACF) DSM allows you to integrate
with an IBM zOS mainframe using IBM RACF for auditing transactions. SIEM
records all relevant and available information from the event.
To integrate the IBM RACF events into SIEM:
1
The IBM mainframe system records all security events as Service Management
Framework (SMF) records in a live repository.
2
At midnight, the IBM RACF data is extracted from the live repository using the SMF
dump utility. The RACFICE utility IRRADU00 (an IBM utility) creates a log file
containing all of the events and fields from the previous day in raw SMF record
format.
3
The QEXRACF program pulls data from the SMF formatted file, as described
above. The program only pulls the relevant events and fields for SIEM and writes
that information in a condensed format for SIEM compatibility. The information is
also saved in a location accessible by SIEM.
4
SIEM uses the log file protocol source to pull the QEXRACF output file and sends
that information back to SIEM on a scheduled basis. SIEM then imports and
process this file.
This document includes:
• Configuring IBM RACF to Integrate with SIEM