Enterasys Security Information and Event Manager, Configuration Manual

Page: 274 / 426

Configuring DSMs
258 N
ORTEL
N
ETWORKS
Step 4
Select Close .
Step 5
To create the OPSEC connection, select Manage > Servers and OPSEC
applications > New > OPSEC Application Properties .
Step 6
Type the Name and optional Comment.
The name you type must be different than the name in Step 2 .
Step 7
From the Host drop-down menu, select the host object you have created in Step 1 .
Step 8
From Application Properties , select User Defined as the vendor.
Step 9
From Client Entries , select LEA .
Step 10
Click Communication to generate a Secure Internal Communication (SIC)
certificate and enter an activation key.
Step 11
Click OK and then click Close .
Step 12
To install the Security Policy on your firewall, select Policy > Install > OK .
Nortel Threat
Protection System
A SIEM Nortel Threat Protection System (TPS) DSM accepts events using syslog.
SIEM records all relevant events.
Before configuring a Nortel TPS device in SIEM, you must:
Step 1
Log in to the Nortel TPS user interface.
Step 2
Select Policy & Response > Intrusion Sensor > Detection & Prevention .
The Detection & Prevention window is displayed.
Step 3
Click Edit next to the intrusion policy you want to configure alerting option.
The Edit Policy window is displayed.
Step 4
Click Alerting .
The Alerting window is displayed.
Step 5
Under Syslog Configuration , select on next to State to enable syslog alerting.
Step 6
From the drop-down list boxes, select the facility and priority levels.
Step 7
Optional. In the Logging Host field, type the IP address of your SIEM system. This
configures your SIEM system to be your logging host. Separate multiple hosts with
commas.
Step 8
Click Save .
The syslog alerting configuration is saved.
Step 9
Apply the policy to your appropriate detection engines.
Step 10
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Nortel TPS device:

From the Log Source Type drop-down list box, select the Nortel Threat
Protection System (TPS) Intrusion Sensor option.