Enterasys Security Information and Event Manager, Configuration Manual

Page: 237 / 426

Configuring DSMs
Microsoft SQL Server
221
For more information about your server, see your vendor documentation.
Microsoft SQL
Server
A SIEM Microsoft SQL Server DSM accepts SQL audit events using syslog. You
can integrate Microsoft SQL Server with SIEM using the Adaptive Log Exporter.
For more information on the Adaptive Log Exporter, see the
Adaptive Log Exporter
Users Guide .
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Microsoft SQL Server:

From the Log Source Type drop-down list box,select the Microsoft SQL
Server option.
For more information on configuring devices, see the Log Sources User Guide .
For more information about your server, see your vendor documentation.
Microsoft Windows
Security Event Log
A SIEM Microsoft Windows Security Event Log DSM accepts events using syslog
from relevant authentication and authorization events.
After you have completed the Before You Begin section, you can integrate Window
Microsoft Security Event Log with SIEM using one of the following methods:
• Use the SIEM Adaptive Log Exporter. For more information on the Adaptive Log
Exporter, see the
Adaptive Log Exporter Users Guide .
• Use the Microsoft Security Event Log protocol. For more information, see the
Log Sources User Guide.
• Set-up the Snare Agent to forward Microsoft Windows Security Event Logs to
SIEM. See
Using the Snare Agent
Before You Begin Before you install the Windows Security Event Log protocol, you must configure
your system DCOM settings for each host you want to monitor. Ensure the
following is configured for each host:
•
Make sure you have appropriate administrative permissions. For this process,
you must be a member of the Administrators group on the remote computer.
•
Make sure you have Windows 2000, Windows 2003, Windows 2008, XP, or
Vista software, or Windows 7 installed. The Windows Event Log Protocol
supports 32 or 64-bit systems.
•
Configure DCOM and enable the host.
•
Enable Windows Management Instrumentation on the host.
• Activate the remote registry service.
• If a firewall is installed on the host (for example, Windows firewall) or is located
between the host and SIEM (such as a hardware or other intermediary firewall),