Enterasys Security Information and Event Manager, Configuration Manual

Page: 353 / 426

Configuring DSMs
65 S
TONESOFT
M
ANAGEMENT
C
ENTER
The SIEM Stonesoft Management Center DSM accepts events using syslog. SIEM
records all relevant LEEF formatted syslog events. Before configuring SIEM, you
must configure your Stonesoft Management Center to export LEEF formatted
syslog events.
This document includes the steps required to edit LogServerConfiguration.txt file.
Configuring the text file allows Stonesoft Management Center to export event data
in LEEF format using syslog to SIEM. For detailed configuration instructions, see
the
StoneGate Management Center Administrator’s Guide .
The following steps are required to integrate Stonesoft Management Center with
SIEM:
1 Configuring the Log Server
2 Configuring a Traffic Rule for Syslog
3 Configuring the Log Source in SIEM
Configuring the Log
Server
To configure Stonesoft Management Center, perform the following steps:
Step 1
Log in to the appliance hosting your Stonesoft Management Center.
Step 2
Stop the Stonesoft Management Center Log Server:
• Windows - Select one of the following methods to stop the Log Server:
- Stop the Log Server in the Windows Services list.
- Run the batch file
<installation path>/bin/sgStopLogSrv.bat
.
• Linux - To stop the Log Server in Linux, run the script
<installation
path>/bin/sgStopLogSrv.sh
.
Step 3
Edit the LogServerConfiguration.txt file. The configuration file is located in the
following directory:
<installation path>/data/LogServerConfiguration.txt
Step 4
Configure the following parameters in the LogServerConfiguration.txt file: