Enterasys Security Information and Event Manager, Configuration Manual

Page: 210 / 426

Configuring DSMs
194 M
C
A
FEE
b
If you are using a version of McAfee Intrushield that has patches applied from
3.x and above, type the following to customize the message string:
|$IV_ALERT_ID$|$IV_ALERT_TYPE$|$IV_ATTACK_TIME$|"$IV_ATTACK_
NAME$"|$IV_ATTACK_ID$|$IV_ATTACK_SEVERITY$|$IV_ATTACK_
SIGNATURE$|$IV_ATTACK_CONFIDENCE$|$IV_ADMIN_DOMAIN$|$IV_
SENSOR_NAME$|$IV_INTERFACE$|$IV_SOURCE_IP$|$IV_SOURCE_PORT$|
$IV_DESTINATION_IP$|$IV_DESTINATION_PORT$|
The custom message string must be entered as a single line, no carriage
returns. Versions of McAfee Intrushield with patches applied use custom
message strings that begin with
$IV
. If you are unsure what string type to use,
contact McAfee Customer Support.
Step 8
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a McAfee IntruShield device:

From the Log Source Type drop-down list box, select McAfee IntruShield
Network IPS Appliance .
For more information on configuring log sources, see the Log Sources User Guide .
For more information on McAfee Intrushield, see your vendor documentation.
McAfee ePolicy
Orchestrator
A SIEM McAfee ePolicy Orchestrator (ePO) DSM accepts events using Java
Database Connectivity (JDBC) or Simple Network Management Protocol
(SNMPv2, and SNMPv3). SIEM records all relevant ePO anti-virus events from
JDBC or SNMP. You can configure McAfee ePolicy Orchestrator to integrate with
SIEM using one of the following methods:
•
Configuring SIEM to Receive Events Using the JDBC Protocol
•
Configuring ePO to Forward SNMP Events
Configuring SIEM to
Receive Events
Using the JDBC
Protocol
To configure SIEM to access the ePO database using the JDBC protocol:
Step 1
Click the Admin tab.
Step 2
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 3
Click the Log Sources icon.
The Log Sources window is displayed.
Step 4
Click Add .
The Add a log source window is displayed.
Step 5
Select the McAfee ePolicy Orchestrator option from the Log Source Type
drop-down list box.