Enterasys Security Information and Event Manager, Configuration Manual

Page: 344 / 426

Configuring DSMs
328 S
OURCEFIRE
You are now ready to configure the log source in SIEM.
Configuring the
Sourcefire Defense
Center Log Source
To configure SIEM to receive events from a Sourcefire Defense Center device, you
must:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
Select the Sourcefire Defense Center option from the Log Source Type
drop-down list box.
Step 7
From the Protocol Configuration drop-down list box, select Sourcefire Defense
Center Estreamer .
Step 8
Configure the following parameters:
-o The -o parameter allows you to overrides the default estreamer name
for the keystore and truststore files. The -o parameter is required
when using multiple Sourcefire Defense Center devices, as unique
key file names are required. For example,
/opt/qradar/bin/estreamer-cert-import.pl -f <file
name> -o 192.168.1.100
The import script creates the following files:
/opt/qradar/conf/192.168.0.100.keystore
/opt/qradar/conf/192.168.0.100.truststore
-d The -d parameter allows you to enable verbose mode when using the
import script. Verbose mode is intended to display error messages
for troubleshooting purposes when pkcs12 files fail to import
properly.
-p The -p parameter allows you to specify a password if a password was
accidently provided when generating the pcks12 file.
-v The -v parameter displays the version information for the import
script.
-h The -h parameter displays a help message on using the import script.
Table 62-3 Sourcefire Defense Center Import Script Parameters (continued)
Parameter Description