Enterasys Security Information and Event Manager, Configuration Manual

Page: 329 / 426

Configuring DSMs
Sophos Enterprise Console 313
Once you have created your custom view, you must configure SIEM to receive
event information using the JDBC protocol.
To configure the Sophos Enterprise Console DSM with SIEM, see Configure SIEM
to Receive Events .
Configure SIEM to
Receive Events
To configure SIEM to access the Sophos database using the JDBC protocol:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
Using the Log Source Type drop-down list box, select Sophos Enterprise
Console .
Step 7
Using the Protocol Configuration drop-down list box, select JDBC .
NOTE
You must refer to the Configure Database Settings on your Sophos Enterprise
Console to define the parameters required to configure the Sophos Enterprise
Console DSM in SIEM.
Step 8
Configure the following values:
Table 61-5 Sophos Enterprise Console JDBC Parameters
Parameter Description
Log Source
Identifier Type the identifier for the log source. Type the log source identifier
in the following format:
<Sophos Database>@<Sophos Database Server IP or
Host Name>
Where:
<Sophos Database>
is the database name, as entered in the
Database Name parameter.
<Sophos Database Server IP or Host Name>
is the
hostname or IP address for this log source, as entered in the IP or
Hostname parameter.
Note: When defining a name for your log source identifier, you
must use the values of the Sophos Database and Database Server
IP address or hostname from the Management Enterprise
Console.