Enterasys Security Information and Event Manager, Configuration Manual

Page: 230 / 426

Configuring DSMs
214 M
ICROSOFT
By default Microsoft DHCP is configured to write audit logs to the
%WINDIR%\system32\dhcp\ directory.
Step 5
Restart the DHCP service.
You are now ready to configure the log source and protocol in SIEM:
Step 1
To configure SIEM to receive events from a Microsoft DHCP Server, you must
select the
Microsoft DHCP Server option from the Log Source Type drop-down
list box.
Step 2
To configure the protocol, you must select the Microsoft DHCP option from the
Protocol Configuration drop-down list box. For more information on configuring
the Microsoft DHCP protocol, see the Log Sources User Guide .
NOTE
To integrate Microsoft DHCP Server versions 2000/2003 with SIEM using the
Adaptive Log Exporter Microsoft DHCP devices, see the SIEM Adaptive Log
Exporter Users Guide. For more information about your server, see your vendor
documentation.
Microsoft IIS Server
A SIEM Microsoft Internet Information Services (IIS) Server DSM accepts FTP,
HTTP, NNTP, and SMTP events using syslog. You can integrate a Microsoft IIS
Server with SIEM using one of the following methods:
• Configure SIEM to connect to your Microsoft IIS Server using the IIS Protocol.
The IIS Protocol collects HTTP events from Microsoft IIS servers. For more
information, see
Configuring Microsoft IIS Using the IIS Protocol .
•
Configure a Snare Agent with your Microsoft IIS Server to forward event
information to SIEM. For more information, see
Configuring Microsoft IIS Using
a Snare Agent .
•
Configure the Adaptive Log Exporter to forward IIS events to SIEM. For more
information, see
Configuring Microsoft IIS Using the Adaptive Log Exporter .
For more information on the Adaptive Log Exporter, see the SIEM Adaptive Log
Exporter Users Guide.
Table 41-2 Microsoft DHCP Log File Examples
Log Type Example
IPv4
DhcpSrvLog-Mon.log
IPv6
DhcpV6SrvLog-Wed.log
Table 41-1 Microsoft IIS Supported Log Types
Version
Supported Log
Type
Method of Import for SIEM
Microsoft IIS 6.0 SMTP, NNTP,
FTP, HTTP IIS Protocol