Enterasys Security Information and Event Manager, Configuration Manual

Page: 239 / 426

Configuring DSMs
Microsoft Operations Manager
223
You are now ready to configure the log source in SIEM:
Step 1
To configure SIEM to receive events from Windows security event logs, you must
select the
Microsoft Windows Security Event Log option from the Log Source
Type drop-down list box.
Step 2
To configure the Windows Event Log protocol, you must select the Microsoft
Security Event Log option from the Protocol Configuration drop-down list box.
Your system must be running the latest version of the Windows Event Log protocol
to retrieve File Replication and Directory Service log types:
For more information on configuring devices, see the Log Sources User Guide .
For more information about your server, see your vendor documentation.
Microsoft
Operations
Manager
A SIEM Microsoft Operations Manager DSM accepts Microsoft Operations
Manager (MOM) events by polling the OnePoint database allowing SIEM to record
the relevant events.
Before you configure SIEM to integrate with the Microsoft Operations Manager,
you must ensure a database user account is configured with appropriate
permissions to access the MOM OnePoint SQL Server database. Access to the
OnePoint database SDK views is managed through the MOM SDK View User
database role. For more information, please see your Microsoft Operations
Manager documentation.
NOTE
Make sure that no firewall rules are blocking the communication between SIEM
and the SQL Server database associated with MOM. For MOM installations that
use a separate, dedicated computer for the SQL Server database, the
SDKEventView view is queried on the database system, not the system running
MOM.
To configure SIEM to receive MOM events:
Step 1
Click the Admin tab.
Step 2
On the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 3
Click the Log Sources icon.
The Log Sources window is displayed.
Step 4
From the Log Source Type drop-down list box, select Microsoft Operations
Manager .
Step 5
From the Protocol Configuration drop-down list box, select JDBC .
The JDBC protocol parameters appear.
Step 6
Configure the following values: