Enterasys Security Information and Event Manager, Configuration Manual

Page: 178 / 426

Configuring DSMs
162 I
MPERVA
S
ECURE
S
PHERE
a
Go to Policies > Security > Firewall Policy .
b
Select the policy you want to edit to use the alert action.
c
Click the Policy tab.
d
From the Followed Action drop-down list box, select your new action.
e
Ensure your policy is configured as enabled and is applied to the appropriate
server groups.
f
Click Save .
g
Repeat for all required policies.
Step 6
To generate events for each event generated by the SecureSphere device:
a
Create a new action set named
q1labs_events
.
b
Click the arrow beside System Log to move the action interface to the Selected
Actions list.
c
Expand the System Log action group.
d
In the Action Name field, type q1labs_syslog_events .
e
Configure the following parameters:
- Syslog host - Type the IP address of the SIEM system to which you want to
send events.
- Syslog log level - Select INFO .
- Message - Type the following message as a pipe seperated continuous
string:
DeviceType=ImpervaSecuresphere Event|et=$!{Event.eventType}|d
c=Securesphere System Event|sp=$!{Event.sourceInfo.sourcePort
}|s=$!{Event.sourceInfo.sourceIp}|d=$!{Event.destInfo.serverI
p}|dp=$!{Event.destInfo.serverPort}|u=$!{Event.username}|t=$!
{Event.createTime}|sev=$!{Event.severity}|m=$!{Event.message}
f
Select the Run on Every Event check box.
g
Click Save .
Step 7
To enable the
q1labs_events
action created above, you must edit your system
event policies to use the action.
The below procedure details the steps to configure the action for a system event
policy. Repeat this procedure for all required policies.
a
Go to Policies > System Events .
b
Select or create the system event policy you want to edit to use the event
action.
c
Click the Followed Action tab.
d
From the drop-down list box, select the new action.
e
Click Save .
f
Repeat for all required system event policies.