Enterasys Security Information and Event Manager, Configuration Manual

Page: 177 / 426

Configuring DSMs
33 I
MPERVA
S
ECURE
S
PHERE
The SIEM Imperva SecureSphere DSM accepts events using syslog. SIEM
records all relevant events. Before configuring an Imperva SecureSphere device in
SIEM, you must configure your device to send syslog events to SIEM.
To configure the device to send syslog events to SIEM:
Step 1
Log in to your SecureSphere device user interface using administrative privileges.
Step 2
Click the Policies tab.
Step 3
Click the Action Sets tab.
Step 4
To generate events for each alert generated by the SecureSphere device:
a
Create a new action set named
q1labs_alerts
.
b
Click the arrow beside System Log to move the action interface to the Selected
Actions list.
c
Expand the System Log action group.
d
In the Action Name field, type q1labs_syslog_alerts .
e
Configure the following parameters:
- Syslog host - Type the IP address of the SIEM system to which you want to
send events.
- Syslog log level - Select INFO .
- Message - You must type the following message as a pipe separated
continuous string:
DeviceType=ImpervaSecuresphere Alert|an=$!{Alert.alertMetadat
a.alertName}|at=Securesphere Alert|ad=$!{Alert.description}|s
p=$!{Event.sourceInfo.sourcePort}|s=$!{Event.sourceInfo.sourc
eIp}|d=$!{Event.destInfo.serverIp}|dp=$!{Event.destInfo.serve
rPort}|u=$!{Alert.username}|g=$!{Alert.serverGroupName}
f
Select the Run on Every Event check box.
g
Click Save .
Step 5
To enable the
q1labs_alerts
action created above, you must edit your policies
to use the alerts action.
The below procedure details the steps to configure the action for a firewall policy.
Repeat this procedure for all required policies.