Enterasys Security Information and Event Manager, Configuration Manual

Page: 354 / 426

Configuring DSMs
338 S
TONESOFT
M
ANAGEMENT
C
ENTER
Step 5
Save the LogServerConfiguration.txt file.
Step 6
Start the Log Server:
•
Windows - Type
<installation path>/bin/sgStartLogSrv.bat
.
•
Linux - Type
<installation path>/bin/sgStartLogSrv.sh
.
You are now ready to configure a traffic rule for syslog.
NOTE
A firewall rule is only required if your SIEM Console or Event Collector is
separated by a firewall from the Stonesoft Management Server. If no firewall
exists between the Management Server and SIEM, you need to configure the log
source in SIEM. For more information, see
Configuring the Log Source in SIEM .
Configuring a Traffic
Rule for Syslog
If the Stonesoft Management Center and SIEM are separated by a firewall in your
network, you must modify your firewall or IPS policy to allow traffic between the
Stonesoft Management Center and SIEM.
To modify a firewall or IPS policy, perform the following steps:
Step 1
From the Stonesoft Management Center, select one of the following methods for
modifying a traffic rule:
•
Firewall policies - Select Configuration > Configuration > Firewall .
•
IPS policies - Select Configuration > Configuration > IPS .
Table 65-1 Log Server Configuration Options
Parameter Value Description
SYSLOG_EXPORT_FORMAT LEEF Type LEEF as the export format to use for syslog.
SYSLOG_EXPORT_ALERT YES | NO Type one of the following values:
•
Yes - Exports alert entries to SIEM using syslog.
•
No - Alert entries are not exported using syslog.
SYSLOG_EXPORT_FW YES | NO Type one of the following values:
•
Yes - Exports firewall and VPN entries to SIEM using
syslog.
•
No - Firewall and VPN entries are not exported using
syslog.
SYSLOG_EXPORT_IPS YES | NO Type one of the following values:
•
Yes - Exports IPS log file entries to SIEM using
syslog.
•
No - IPS entries are not exported using syslog.
SYSLOG_PORT 514 Type 514 as the UDP port for forwarding syslog events
to SIEM.
SYSLOG_SERVER_ADDRESS SIEM IPv4
Address Type the IPv4 address of your SIEM Console or Event
Collector.