Enterasys Security Information and Event Manager, Configuration Manual

Page: 190 / 426

Configuring DSMs
174 J
UNIPER
N
ETWORKS
Configuring SIEM to
Collect IDP Events
Juniper NSM is a central management server for Juniper IDP. You can configure
SIEM to collect and represent the Juniper IDP alerts as coming from a central
NSM, or SIEM can collect syslog from the individual Juniper IDP device.
To configure SIEM to receive events from Juniper Networks Secure Access
device:

From the Log Source Type drop-down list box, select Juniper Networks
Intrusion Detection and Prevention (IDP) .
For more information on configuring devices, see the Log Sources User Guide .
For more information about NetScreen IDP, see your NetScreen Security Manager
documentation.
Juniper Networks
Secure Access
A SIEM Juniper Networks Secure Access DSM accepts login and session
information using syslog in WebTrends Enhanced Log File (WELF) format. You
can integrate Juniper SA and Juniper IC with SIEM.
NOTE
If your Juniper device is running release 5.5R3-HF2 - 6.1 or above, we
recommend that you use the WELF:WELF format for logging. See your vendor
documentation to determine if your device and license support logging in
WELF:WELF format.
This document provides information for integrating a Juniper Secure Access
device using one of the following formats:
• WELF:WELF (Recommended). See Using WELF:WELF Format .
•
Syslog. See Using Syslog Format .
Using WELF:WELF
Format
To integrate a Juniper Networks Secure Access device with SIEM using the
WELF:WELF format:
Step 1
Log in to your Juniper device administration user interface:
https://10.xx.xx.xx/admin
Step 2
Configure syslog server information for events:
a
If a WELF:WELF file is configured, go to Step f . Otherwise, go to Step b .
b
From the left panel, select System > Log/Monitoring > Events > Filter .
The Filter menu is displayed.
c
Click New Filter .
d
Select WELF .
e
Click Save Changes .
f
From the left panel, select System > Log/Monitoring > Events > Settings .
g
From the Select Events to Log pane, select the events that you wish to log.