Enterasys Security Information and Event Manager, Configuration Manual

Page: 336 / 426

Configuring DSMs
320 S
OPHOS
Configure SIEM to Receive Events From Sophos PureMessage for Microsoft
Exchange
To configure SIEM to access the Sophos PureMessage database using the JDBC
protocol:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
From the Log Source Type drop-down list box, select Sophos PureMessage .
Step 7
From the Protocol Configuration drop-down list box, select JDBC .
NOTE
You must refer to the Configure Database Settings on your Sophos PureMessage
to define the parameters required to configure the Sophos PureMessage DSM in
SIEM.
Step 8
Configure the following values:
Table 61-2 Sophos PureMessage JDBC Parameters
Parameter Description
Log Source
Identifier Type the identifier for the log source. Type the log source identifier
in the following format:
<Sophos PureMessage Database>@<Sophos PureMessage
Database Server IP or Host Name>
Where:
<Sophos PureMessage Database>
is the database name, as
entered in the Database Name parameter.
<Sophos PureMessage Database Server IP or Host
Name>
is the hostname or IP address for this log source, as
entered in the IP or Hostname parameter.
When defining a name for your log source identifier, you must use
the values of the Database and Database Server IP address or
hostname of the Sophos PureMessage device.
Database Type From the drop-down list box, select Postgres .
Database Name Type
pmx_quarantine
.
IP or Hostname Type the IP address or host name of the Sophos PureMessage
server.