Enterasys Security Information and Event Manager, Configuration Manual

Page: 328 / 426

Configuring DSMs
312 S
OPHOS
NOTE
Selecting a value for the Credibility parameter greater than 5 will weight your
Sophos log source with a higher importance compared to other log sources in
SIEM.
Step 9
Click Save .
Step 10
On the Admin tab, click Deploy Changes .
For more information on configuring log sources, see the Log Sources User Guide .
Configure SIEM
Using the JDBC
Protocol
A SIEM Sophos Enterprise Console DSM accepts events using Java Database
Connectivity (JDBC). SIEM records all relevant anti-virus events. This document
provides information on configuring SIEM to access the Sophos Enterprise
Console database using the JDBC protocol.
To integrate SIEM with Sophos Enterprise Console:
Step 1
Log in to your Sophos Enterprise Console device command line interface (CLI).
Step 2
Type the following command to create a custom view in your Sophos database to
support SIEM:
CREATE VIEW threats_view AS SELECT t.ThreatInstanceID,
t.ThreatType, t.FirstDetectedAt, c.Name, c.LastLoggedOnUser,
c.IPAddress, c.DomainName, c.OperatingSystem, c.ServicePack,
t.ThreatSubType, t.Priority, t.ThreatLocalID,
t.ThreatLocalIDSource, t.ThreatName, t.FullFilePathCheckSum,
t.FullFilePath, t.FileNameOffset, t.FileVersion, t.CheckSum,
t.ActionSubmittedAt, t.DealtWithAt, t.CleanUpable,
t.IsFragment, t.IsRebootRequired, t.Outstanding, t.Status,
InsertedAt FROM <Database Name>.dbo.ThreatInstancesAll t,
<Database Name>.dbo.Computers c WHERE t.ComputerID = c.ID;
Where <Database Name> is the name of the Sophos database.
NOTE
The database name must not contain any spaces.
Use Named Pipe
Communication Clear the Use Named Pipe Communications check box.
When using a Named Pipe connection, the username and
password must be the appropriate Windows authentication
username and password and not the database username and
password. Also, you must use the default Named Pipe.
Database
Cluster Name If you select the Use Named Pipe Communication check box, the
Database Cluster Name parameter is displayed. If you are running
your SQL server in a cluster environment, define the cluster name
to ensure Named Pipe communication functions properly.
Table 61-4 Sophos Enterprise Console JDBC Parameters (continued)
Parameter Description