Enterasys Security Information and Event Manager, Configuration Manual

Page: 316 / 426

Configuring DSMs
300 S
AMHAIN
L
ABS
Step 8
Restart syslog:
/etc/init.d/syslog restart
Samhain sends logs using syslog to SIEM.
Step 9
You are now ready to configure Samhain HIDS DSM in SIEM.
To configure SIEM to receive events from Samhain:

From the Log Source Type drop-down list box, select the Samhain HIDS
option.
For more information on configuring log sources, see the Log Sources User Guide .
Using JDBC
You can configure Samhain HIDS to send log alerts to a database. Oracle,
PostgreSQL, and MySQL are natively supported by Samhain. You can also
configure SIEM to collect events from these databases using the JDBC protocol.
NOTE
SIEM Maintenance Release 3 and above do not include a MySQL driver for
JDBC. If you are using a DSM or protocol that requires a MySQL JDBC driver, you
must download and install the platform independent MySQL Connector/J from
http://dev.mysql.com/downloads/connector/j/. For instruction on installing MySQL
Connector/J for the JDBC protocol, see the
Log Sources User Guide .
To configure SIEM to access the Samhain HIDS database using the JDBC
protocol:
Step 1
Log into SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
From the Log Source Type drop-down list box, select the Samhain HIDS option.
Step 7
Using the Protocol Configuration drop-down list box, select JDBC .
The JDBC protocol configuration is displayed.
Step 8
Update the JDBC configuration to include the following values:
a
Database Type:
<Samhain Database Type>
b
Database Name: <
Samhain SetDBName>
c
Table Name: <
Samhain SetDBTable>
d
Select List:
*