Enterasys Security Information and Event Manager, Configuration Manual

Page: 272 / 426

Configuring DSMs
256 N
ORTEL
N
ETWORKS
Configure the Log Source within SIEM
You are now ready to configure the log source in SIEM.
Step 1
To configure SIEM to receive events from a Nortel Switched Firewall 5100 device
using OPSEC, you must select the
Nortel Switched Firewall 5100 option from the
Log Source Type drop-down list box.
Step 2
To configure SIEM to receive events from a Check Point SmartCenter Server using
OPSEC LEA, you must select the
LEA option from the Protocol Configuration
drop-down list box when configuring your protocol configuration.
For more information, see the Log Sources User Guide .
Nortel Switched
Firewall 6000
A SIEM Nortel Switched Firewall 6000 DSM accepts events using either syslog or
OPSEC. SIEM records all relevant events. Before configuring a Nortel Switched
Firewall device in SIEM, you must configure your device to send events to SIEM.
This section provides information on configuring a Nortel Switched Firewall 6000
device with SIEM using one of the following methods:
• Integrating Nortel Switched Firewall Using Syslog
• Integrating Nortel Switched Firewall Using OPSEC
Integrating Nortel
Switched Firewall
Using Syslog
This method ensures the SIEM Nortel Switched Firewall 6000 DSM accepts events
using syslog. Before you configure SIEM to integrate with a Nortel Switched
Firewall 6000 DSM, you must:
Step 1
Log into your Nortel Switched Firewall device command line interface (CLI).
Step 2
Type the following command:
/cfg/sys/log/syslog/add
Step 3
Type the IP address of your SIEM system at the following prompt:
Enter IP address of syslog server:
A prompt is displayed to configure the severity level.
Step 4
Configure
info
as the desired severity level. For example:
Enter minimum logging severity
(emerg | alert | crit | err | warning | notice | info | debug):
info
A prompt is displayed to configure the facility.
Step 5
Configure
auto
as the local facility. For example:
Enter the local facility (auto | local0-local7): auto
Step 6
Apply the configuration:
apply
Step 7
You are now ready to configure the log source in SIEM.