Enterasys Security Information and Event Manager, Configuration Manual

Page: 252 / 426

Configuring DSMs
236 N
AME
V
ALUE
P
AIR
EventName Type the event name that you want to use to identity the
event in the Events interface when using the Event
Mapping functionality. For more information on mapping
events, see the
SIEM Users Guide.
This is a required parameter.
EventCategory Type the event category you want to use to identify the
event in the Events interface. If this value is not included in
the log message, the value
NameValuePair
value is
used.
SourceIp Type the source IP address for the message.
SourcePort Type the source port for the message.
SourceIpPreNAT Type the source IP address for the message before
Network Address Translation (NAT) occurred.
SourceIpPostNAT Type the source IP address for the message after NAT
occurs.
SourceMAC Type the source MAC address for the message.
SourcePortPreNAT Type the source port for the message before NAT occurs.
SourcePortPostNAT Type the source port for the message after NAT occurs.
DestinationIp Type the destination IP address for the message.
DestinationPort Type the destination port for the message.
DestinationIpPreNAT Type the destination IP address for the message before
NAT occurs.
DestinationIpPostNAT Type the IP address for the message after NAT occurs.
DestinationPortPreNAT Type the destination port for the message before NAT
occurs.
DestinationPortPostNAT Type the destination port for the message after NAT
occurs.
DestinationMAC Type the destination MAC address for the message.
DeviceTime Type the time that the event was sent, according to the
device. The format is: YY/MM/DD hh:mm:ss. If no specific
time is provided, the syslog header or DeviceType
parameter is applied.
UserName Type the user name associated with the event.
HostName Type the host name associated with the event. Typically,
this parameter is only associated with identity events.
GroupName Type the group name associated with the event. Typically,
this parameter is only associated with identity events.
NetBIOSName Type the NetBIOS name associated with the event.
Typically, this parameter is only associated with identity
events.
Table 44-1 NVP Log Format Tags (continued)
Tag Description