Enterasys Security Information and Event Manager, Configuration Manual

Page: 343 / 426

Configuring DSMs
Sourcefire Defense Center (DC) 327
- If you are using a remote Event Collector to collect eStreamer events, type
the IP address or hostname for the remote Event Collector.
- If you are using HA, type the virtual IP address.
c
Leave the password field blank.
d
Click Save .
The new client is added to the Streamer Client list.
Step 4
From the Certificate Location column, click the client you created to save the
pkcs12 certificate to a file location and click OK .
Step 5
Open a Secure Shell (SSH) connection to your SIEM Console or remote Event
Collector and copy the pkcs12 certificate to the following directory:
/opt/qradar/bin/
Step 6
Type the following command and any additional option parameters to import your
pkcs12 file:
/opt/qradar/bin/estreamer-cert-import.pl -f <file name>
<options>
Where:
<file name>
is the file name of the pkcs12 file created by your Sourcefire
Defense Center device.
<options>
are any additional import script parameters from Table 62-3 .
For example,
/opt/qradar/bin/estreamer-cert-import.pl -f 192.168.0.1.pkcs12
The import script creates a keystore and truststore file in the following location:
/opt/qradar/conf/estreamer.keystore
/opt/qradar/conf/estreamer.truststore
NOTE
Any existing Sourcefire Defense Center certificates are renamed to
estreamer.keystore.old and estreamer.truststore.old.
Table 62-3 Sourcefire Defense Center Import Script Parameters
Parameter Description
-f The -f parameter identifies the file name of the pkcs12 files to import.
This is a required parameter to import certificates to SIEM.