Enterasys Security Information and Event Manager, Configuration Manual

Page: 325 / 426

Configuring DSMs
61 S
OPHOS
This section provides information on the following:
• Sophos Enterprise Console
•
Sophos PureMessage
•
Sophos Astaro Security Gateway
• Sophos Web Security Appliance
Sophos Enterprise
Console
SIEM has two options for gathering events from a Sophos Enterprise Console
using JDBC. Select the method that best applies to your Sophos Enterprise
Console installation:
• Configure SIEM Using the Sophos Enterprise Console Protocol
•
Configure SIEM Using the JDBC Protocol
NOTE
To use the Sophos Enterprise Console protocol, you must ensure that the Sophos
Reporting Interface is installed with your Sophos Enterprise Console. If you do not
have the Sophos Reporting Interface, you must configure SIEM using the JDBC
protocol. For information on installing the Sophos Reporting Interface, see your
Sophos Enterprise Console documentation.
Configure SIEM
Using the Sophos
Enterprise Console
Protocol
A SIEM Sophos Enterprise Console DSM accepts events using Java Database
Connectivity (JDBC). The Sophos Enterprise Console DSM works in coordination
with the Sophos Enterprise Console protocol to combine payload information from
anti-virus, application control, device control, data control, tamper protection, and
firewall logs in the vEventsCommonData table and provide these events to SIEM.
You must install the Sophos Enterprise Console protocol before configuring SIEM.
Configure SIEM to Receive Events
To configure SIEM to access the Sophos database using the JDBC protocol:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.