Enterasys Security Information and Event Manager, Configuration Manual

Page: 220 / 426

Configuring DSMs
204 M
C
A
FEE
Importing the Syslog Log Handler
To Import a policy rule set for the syslog handler:
Step 1
From the Enterasys Extranet, download the following compressed file:
log_handlers.tar.gz
Step 2
Extract the file.
This will give you the syslog handler file required to configure your McAfee Web
Gateway appliance.
syslog_loghandler.xml
Step 3
Log in to your McAfee Web Gateway console.
Step 4
Using the menu toolbar, click Policy .
Step 5
Click Log Handler .
Step 6
Using the menu tree, select Default .
Step 7
From the Add drop-down list box, select Rule Set from Library .
The Add a Rule Set from Library window is displayed.
Step 8
Click Import from File button .
Step 9
Navigate to the directory containing the syslog_handler file you downloaded
in
Step 1 , and select syslog_loghandler.xml as the file to import.
NOTE
If the McAfee Web Gateway appliance detects any conflicts with the rule set, you
must resolve the conflict. For more information, see your McAfee Web Gateway
documentation.
Step 10
Click OK .
Step 11
Click Save Changes .
Step 12
You are now ready to configure the log source in SIEM.
SIEM automatically discovers syslog events from a McAfee Web Gateway
appliance.

If you want to manually configure SIEM to receive syslog events, select
McAfee Web Gateway from the Log Source Type drop-down list box.
For more information on configuring log sources, see the Log Sources User Guide .
Configuring McAfee
Web Gateway for the
Log File Protocol
The McAfee Web Gateway appliance allows you to forward event log files to an
interim file server for retrieval by SIEM.
Step 1
From the Enterasys Extranet, download the following file:
log_handlers.tar.gz
Step 2
Extract the file.