Enterasys Security Information and Event Manager, Configuration Manual

Page: 228 / 426

Configuring DSMs
212 M
ICROSOFT
Step 7
You are now ready to configure SIEM to receive events from a Microsoft Exchange
Server.
To configure SIEM to receive events from the Microsoft Exchange Server:

From the Log Source Type drop-down list box, select the Microsoft
Exchange Server option, or configure the Adaptive Log Exporter.
For information about the Adaptive Log Exporter, see the Adaptive Log Exporter
Users Guide .
For information about the Microsoft Exchange Protocol, see the Log Sources User
Guide .
For more information about your Microsoft Exchange Server, see your vendor
documentation.
Integrating with SIEM
Using SMTP
To integrate SIEM with the Microsoft Exchange Server DSM:
Step 1
In the Exchange System Manager menu tree, expand Servers > Protocols >
SMTP .
Step 2
Right-click on Default SMTP Virtual Server and select Properties .
The Default SMTP Virtual Server Properties window is displayed.
Step 3
From the Active Log Format drop-down list box, choose one of the following
options:
•
Select NCSA . Go to Step 7 .
•
Select IIS . Go to Step 7 .
• Select W3C . Go to Step 4 .
Step 4
Click Properties .
The W3C Properties window is displayed.
Step 5
Click the Advanced tab.
Step 6
From the list of properties, select all properties that you want to apply to the
Microsoft Exchange Server DSM. The selected properties must include the
following:
a
Select the Method (cs-method) check box.
b
Select the Protocol Version (cs-version) check box.
Step 7
Click OK .
Step 8
You are now ready to configure SIEM to receive events from a Microsoft Exchange
Server.
To configure SIEM to receive events from the Microsoft Exchange Server: