Enterasys Security Information and Event Manager, Configuration Manual

Page: 355 / 426

Configuring DSMs
339
Step 2
Select the type of policy to modify:
• Firewall - Select Firewall Policies > Edit Firewall Policy .
•
IPS - Select IPS Policies > Edit Firewall Policy .
Step 3
Add an IPv4 Access rule with the following values to the firewall policy:
a
Source - Type the IPv4 address of your Stonesoft Management Center Log
Server.
b
Destination - Type the IPv4 address of your SIEM Console or Event Collector.
c
Service - Select Syslog (UDP) .
d
Action - Select Allow .
e
Logging - Select None .
NOTE
In most cases, we recommend setting the logging value to None . Logging syslog
connections without configuring a syslog filter can create a loop. For more
information, see the
StoneGate Management Center Administrator’s Guide .
Step 4
Save your changes and refresh the policy on the firewall or IPS.
You are now ready to configure the log source in SIEM.
Configuring the Log
Source in SIEM
SIEM automatically detects syslog events from the Stonesoft Management Center.
However, if you want to manually configure SIEM to receive events your from
Stonesoft Management Center:

From the Log Source Type drop-down list box, select Stonesoft
Management Center .
For more information on configuring log sources, see the Log Sources Users
Guide.