Enterasys Security Information and Event Manager, Configuration Manual

Page: 326 / 426

Configuring DSMs
310 S
OPHOS
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
From the Log Source Type drop-down list box, select Sophos Enterprise
Console .
Step 7
From the Protocol Configuration drop-down list box, select Sophos Enterprise
Console JDBC .
NOTE
You must refer to the Configure Database Settings on your Sophos Enterprise
Console to define the parameters required to configure the Sophos Enterprise
Console JDBC protocol in SIEM.
Step 8
Configure the following values:
Table 61-4 Sophos Enterprise Console JDBC Parameters
Parameter Description
Log Source
Identifier Type the identifier for the log source. Type the log source identifier
in the following format:
<Sophos Database>@<Sophos Database Server IP or
Host Name>
Where:
<Sophos Database>
is the database name, as entered in the
Database Name parameter.
<Sophos Database Server IP or Host Name>
is the
hostname or IP address for this log source, as entered in the IP or
Hostname parameter.
Note: When defining a name for your log source identifier, you
must use the values of the Sophos Database and Database Server
IP address or hostname from the Management Enterprise
Console.
Database Type From the drop-down list box, select MSDE .
Database Name Type the exact name of the Sophos database.
IP or Hostname Type the IP address or host name of the Sophos SQL Server.
Port Type the port number used by the database server. The default
port for MSDE in Sophos Enterprise Console is 1168.
The JDBC configuration port must match the listener port of the
Sophos database. The Sophos database must have incoming TCP
connections enabled to communicate with SIEM.
Note: If you define a Database Instance when using MSDE as the
database type, you must leave the Port parameter blank in your
SIEM configuration.
Username Type the username required to access the database.