Enterasys Security Information and Event Manager, Configuration Manual

Page: 315 / 426

Configuring DSMs
57 S
AMHAIN
L
ABS
The Samhain Labs Host-Based Intrusion Detection System (HIDS) monitors
changes to files on the system. The Samhain HIDS DSM supports Samhain
version 2.4 when used for File Integrity Monitoring (FIM).
You can configure the Samhain HIDS DSM to accept one of the following log
types:
•
Using Syslog
•
Using JDBC
Using Syslog
Before you configure SIEM to integrate with Samhain HIDS using syslog, you must
configure the Samhain HIDS system to forward logs to your SIEM system.
NOTE
The following procedure is based on the default samhainrc file. If the samhainrc
file has been modified, some values (such as syslog facility) may be different.
To configure Samhain HIDS to forward logs using syslog to SIEM:
Step 1
Log in to Samhain HIDS from the command line interface.
Step 2
Open the following file:
/etc/samhainrc
Step 3
Remove the comment marker (
#
) from the following line:
SetLogServer=info
Step 4
Save and exit the file.
Alerts are sent to the local system’s syslog.
Step 5
Open the following file:
/etc/syslog.conf
Step 6
Add the following line:
local2.* @<IP Address>
Where
<IP Address>
is the IP address of the Event Collector.
Step 7
Save and exit the file.