Enterasys Security Information and Event Manager, Configuration Manual

Page: 335 / 426

Configuring DSMs
Sophos PureMessage 319
NOTE
Selecting a value for the Credibility parameter greater than 5 will weight your
Sophos PureMessage log source with a higher importance compared to other log
sources in SIEM.
Step 9
Click Save .
Step 10
On the Admin tab, click Deploy Changes .
For more information on configuring log sources, see the Log Sources User Guide .
Integrating SIEM with
Sophos
PureMessage for
Linux
To integrate SIEM with Sophos PureMessage for Linux:
Step 1
Navigate to your Sophos PureMessage PostgreSQL database directory:
cd /opt/pmx/postgres-8.3.3/bin
Step 2
Access the pmx_quarantine database SQL prompt:
./psql -d pmx_quarantine
Step 3
Type the following command to create a SIEM view in your Sophos database to
support SIEM:
create view siem_view as select 'Linux PureMessage' as
application, id, b.name, m_date, h_from_local, h_from_domain,
m_global_id, m_message_size, outbound, h_to, c_subject_utf8 from
message a, m_reason b where a.reason_id = b.reason_id;
Once you have created your SIEM view, you must configure SIEM to receive event
information using the JDBC protocol.
To configure the Sophos PureMessage DSM with SIEM, see Configure SIEM to
Receive Events From Sophos PureMessage for Microsoft Exchange .
Use Named Pipe
Communication Clear the Use Named Pipe Communications check box.
When using a Named Pipe connection, the username and
password must be the appropriate Windows authentication
username and password and not the database username and
password. Also, you must use the default Named Pipe.
Database
Cluster Name If you select the Use Named Pipe Communication check box, the
Database Cluster Name parameter is displayed. If you are running
your SQL server in a cluster environment, define the cluster name
to ensure Named Pipe communication functions properly.
Table 61-1 Sophos PureMessage JDBC Parameters (continued)
Parameter Description