Enterasys Security Information and Event Manager, Configuration Manual

Page: 339 / 426

Configuring DSMs
Sophos Web Security Appliance 323
a
POP3 Proxy - Select this check box.
b
Packet Filter - Select this check box.
c
Intrusion Prevention System - Select this check box.
d
Content Filter(HTTPS) - Select this check box.
e
High availability - Select this check box.
f
FTP Proxy - Select this check box.
g
SSL VPN - Select this check box.
h
PPTP daemon - Select this check box.
i
IPSEC VPN - Select this check box.
j
HTTP daemon - Select this check box.
k
User authentication daemon - Select this check box.
l
SMTP proxy - Select this check box.
Step 8
Click Apply .
Step 9
From Remote syslog status section, click Enable .
Step 10
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from your Sophos Astaro Security Gateway
device:

From the Log Source Type drop-down list box, select Sophos Astaro
Security Gateway .
For more information on configuring log sources, see Log Sources User Guide .
Sophos Web
Security Appliance
The SIEM Sophos Web Security Appliance (WSA) DSM accepts events using
syslog. SIEM records all relevant events forwarded from the transaction log of the
Sophos Web Security Appliance. Before configuring SIEM, you must configure
your Sophos WSA appliance to send syslog events to SIEM.
To configure your Sophos Web Security Appliance to forward syslog events:
Step 1
Log in to your Sophos Web Security Appliance.
Step 2
From the menu, select Configuration > System > Alerts & Monitoring .
Step 3
Select the Syslog tab.
Step 4
Select the Enable syslog transfer of web traffic check box.
Step 5
In the Hostname/IP text box, type the address of SIEM or the Event Collector.
Step 6
In the Port text box, type 514 .
Step 7
From the Protocol drop-down list box, select a protocol. The options are:
• TCP - The TCP protocol is supported with SIEM on port 514.
•
UDP - The UDP protocol is supported with SIEM on port 514.