Enterasys Security Information and Event Manager, Configuration Manual

Page: 194 / 426

Configuring DSMs
178 J
UNIPER
N
ETWORKS
Step 4
Type the IP address of your SIEM system hosting the Event Collector.
Step 5
Click Apply .
Step 6
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Juniper Networks Firewall and VPN
device:

From the Log Source Type drop-down list box, select Juniper Networks
Firewall and VPN option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your Juniper Networks Firewall and VPN device, see
your Juniper documentation.
Juniper Networks
Network and
Security Manager
The SIEM Juniper Networks Network and Security Manager (NSM) DSM accepts
Juniper Networks SSG logs and Juniper Networks NSM logs. All Juniper SSG logs
must be forwarded through Juniper NSM to SIEM. All other Juniper devices should
be forwarded directory to SIEM.
For more information on advanced filtering of Juniper Networks NSM logs, see
your Juniper Networks vendor documentation.
To integrate a Juniper Networks NSM device with SIEM, you must:
•
Configuring Juniper Networks NSM to Export Logs to Syslog
•
Configuring SIEM to Collect IDP Events
Configuring Juniper
Networks NSM to
Export Logs to
Syslog
Juniper Networks NSM uses the syslog server when exporting qualified log entries
to syslog. Configuring the syslog settings for the management system only defines
the syslog settings for the management system. It does not actually export logs
from the individual devices.
To enable the management system to export logs to syslog:
Step 1
Log in to the Juniper Networks NSM user interface.
Step 2
From the Action Manager menu, select Action Parameters .
Step 3
Type the IP address for the syslog server to which you want to send qualified logs.
Step 4
Type the syslog server facility for the syslog server to which you want to send
qualified logs.
Step 5
From the Device Log Action Criteria node, select the Actions tab.
Step 6
Select Syslog Enable for Category , Severity , and Action .
Step 7
You are now ready to configure the log source in SIEM.