Enterasys Security Information and Event Manager, Configuration Manual

Page: 285 / 426

Configuring DSMs
50 O
PEN
S
OURCE
SNORT
A SIEM Open Source SNORT DSM accepts SNORT events using syslog. SIEM
records all relevant SNORT events. SourceFire’s VRT certified rules for registered
SNORT users are supported, however, Bleeding Edge, Emerging Threat, and
other third-party rule sets may not be fully supported by the Open Source SNORT
DSM.
NOTE
The below procedure applies to a system operating Red Hat Enterprise. The
procedures below may vary for other operating systems.
Before you configure SIEM to integrate with a SNORT device, you must:
Step 1
Configure SNORT on a remote system.
Step 2
Open the
snort.conf
file.
Step 3
Uncomment the following line:
output alert_syslog:LOG_AUTH LOG_INFO
Step 4
Save and exit the file.
Step 5
Open the following file:
/etc/init.d/snortd
Step 6
Add an
-s
to the following lines, as shown in the example below:
daemon /usr/sbin/snort $ALERTMODE $BINARY_LOG $NO PACKET_LOG
$DUMP_APP -D $PRINT_INTERFACE -i $i -s -u $USER -g $GROUP $CONF
-i $LOGIR/$i $PASS_FIRST
daemon /usr/sbin/snort $ALERTMODE $BINARY_LOG $NO_PACKET_LOG
$DUMP_APP -D $PRINT_INTERFACE $INTERFACE -s -u $USER -g $GROUP
$CONF -i $LOGDIR
Step 7
Save and exit the file.
Step 8
Restart SNORT:
/etc/init.d/snortd restart
Step 9
Open the
syslog.conf
file.
Step 10
Update the file to reflect the following:
auth.info @<IP Address>