Enterasys Security Information and Event Manager, Configuration Manual

Page: 216 / 426

Configuring DSMs
200 M
C
A
FEE
Configuring the Log Source in SIEM
You are now ready to configure the log source and protocol in SIEM:
Step 1
To configure SIEM to receive events from a McAfee ePO device, you must select
the
McAfee ePolicy Orchestrator option from the Log Source Type drop-down
list box.
Step 2
To configure SNMP, you must select the same SNMP version configured on your
McAfee ePO device. From the
Protocol Configuration drop-down list box, select
the SNMPv2 , or SNMPv3 option.
Step 3
If you are using SNMPv2 or SNMPv3, you must select the Include OIDs in Event
Payload check box.
For more information on configuring SNMP on your ePO device, see the McAfee
website at http://www.mcafee.com.
McAfee Application
/ Change Control
A SIEM McAfee Application / Change Control DSM accepts change control events
using Java Database Connectivity (JDBC). SIEM records all relevant McAfee
Application / Change Control events. This document includes information on
configuring SIEM to access the database containing events using the JDBC
protocol.
To configure SIEM:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
Using the Log Source Type drop-down list box, select McAfee Application /
Change Control .
Step 7
Using the Protocol Configuration drop-down list box, select JDBC .
You must refer to the Configure Database Settings on your ePO Management
Console to configure the McAfee Application / Change Control DSM in SIEM.
Step 8
Configure the following values: