Enterasys Security Information and Event Manager, Configuration Manual

Page: 219 / 426

Configuring DSMs
McAfee Web Gateway 203
NOTE
Selecting a value for the Credibility parameter greater than 5 will weight your
McAfee Application / Change Control log source with a higher importance
compared to other log sources in SIEM.
Step 9
Click Save .
Step 10
On the Admin tab, click Deploy Changes .
For more information on configuring log sources, see the Log Sources User Guide .
McAfee Web
Gateway
You can configure McAfee Web Gateway to integrate with SIEM using one of the
following methods:
•
Configuring McAfee Web Gateway for Syslog
• Configuring McAfee Web Gateway for the Log File Protocol
NOTE
McAfee Web Gateway is formerly known as McAfee WebWasher.
Configuring McAfee
Web Gateway for
Syslog
To integrated McAfee Web Gateway with SIEM:
Step 1
Log in to your McAfee Web Gateway console.
Step 2
Using the toolbar, click Configuration .
Step 3
Click the File Editor tab.
Step 4
Expand the appliance files and select the file /etc/rsyslog.conf.
The file editor displays the rsyslog.conf file for editing.
Step 5
Modify the rsyslog.conf file to include the following information:
# send access log to siem
*.info;daemon.!=info;mail.none;authpriv.none;cron.none
-/var/log/messages
*.info;mail.none;authpriv.none;cron.none @<IP Address>:<Port>
Where:
<IP Address>
is the IP address of SIEM.
<Port>
is the syslog port number, for example 514.
Step 6
Click Save Changes .
You are now ready to import a policy for the syslog handler on your McAfee Web
Gateway appliance. For more information, see
Importing the Syslog Log Handler .