Enterasys Security Information and Event Manager, Configuration Manual

Page: 209 / 426

Configuring DSMs
39 M
C
A
FEE
This section provides information on the following DSMs:
• McAfee Intrushield
•
McAfee ePolicy Orchestrator
•
McAfee Application / Change Control
• McAfee Web Gateway
McAfee Intrushield
A SIEM McAfee Intrushield DSM accepts events using syslog. SIEM records all
relevant events. Before you configure SIEM to integrate with a McAfee Intrushield
device, you must:
Step 1
Log in to the McAfee Intrushield Manager user interface.
Step 2
In the dashboard click Configure .
Step 3
From the Resource Tree, click the root node (Admin-Domain-Name).
Step 4
Select Alert Notification > Syslog Forwarder .
Step 5
Type the Syslog Server details.
a
The Enable Syslog Forwarder must be configured as Yes .
b
The Port must be configured to 514 .
Step 6
Click Edit .
Step 7
Choose one of the following:
a
If you are using a version of McAfee Intrushield that does not have patches
applied, type the following to customize the message string:
|$ALERT_ID$|$ALERT_TYPE$|$ATTACK_TIME$|"$ATTACK_NAME$"|
$ATTACK_ID$|$ATTACK_SEVERITY$|$ATTACK_SIGNATURE$|$ATTACK_
CONFIDENCE$|$ADMIN_DOMAIN$|$SENSOR_NAME$|$INTERFACE$|
$SOURCE_IP$|$SOURCE_PORT$|$DESTINATION_IP$|$DESTINATION
_PORT$|
The custom message string must be entered as a single line, no carriage
returns. Versions of McAfee Intrushield that do not have patches applied use
different message strings than patched versions. If you are unsure what string
type to use, contact McAfee Customer Support.