Enterasys Security Information and Event Manager, Configuration Manual

Page: 319 / 426

Configuring DSMs
58 S
ENTRIGO
H
EDGEHOG
You can integrate a Sentrigo Hedgehog device with SIEM. A Sentrigo Hedgehog
device accepts LEEF events using syslog. Before you configure SIEM to integrate
with a Sentrigo Hedgehog device, you must:
Step 1
Log in to the Sentrigo Hedgehog command line interface (CLI).
Step 2
Open the following file for editing:
<Installation directory>/conf/sentrigo-custom.properties
Where
<Installation directory>
is the directory containing your Sentrigo
Hedgehog installation.
Step 3
Add the following log.format entries to the custom properties file:
NOTE
Depending on your Sentrigo Hedgehog configuration or installation, you may be
required to replace or overwrite the existing log.format entry.
sentrigo.comm.ListenAddress=1996
log.format.body.custom=usrName=$osUser:20$|duser=$execUser:20$|
sev=$severity$|identHostName=$sourceHost$|src=$sourceIP$|dst=$a
gent.ip$|devTime=$logonTime$|devTimeFormat=EEE MMM dd HH:mm:ss z
yyyy|cmdType=$cmdType$|externalId=$id$|execTime=$executionTime.
time$|dstServiceName=$database.name:20$|srcHost=$sourceHost:30$
|execProgram=$execProgram:20$|cmdType=$cmdType:15$|oper=$operat
ion:225$|accessedObj=$accessedObjects.name:200$
log.format.header.custom=LEEF:1.0|Sentrigo|Hedgehog|$serverVers
ion$|$rules.name:150$|
log.format.header.escaping.custom=\\|
log.format.header.seperator.custom=,
log.format.header.escape.char.custom=\\
log.format.body.escaping.custom=\=
log.format.body.escape.char.custom=\\
log.format.body.seperator.custom=|
log.format.empty.value.custom=NULL
log.format.length.value.custom=10000
log.format.convert.newline.custom=true
Step 4
Save the custom properties file.