Enterasys Security Information and Event Manager, Configuration Manual

Page: 359 / 426

Configuring DSMs
Sun Solaris Basic Security Mode (BSM) 343
mail.*; @<IP address>
Where
<IP address>
is the IP address of the SIEM system. Use tabs instead of
spaces to format the line.
NOTE
Depending on the version of Solaris you are running, you may need to add
additional log types to the file. Contact your system administrator for more
information.
Step 4
Save and exit the file.
Step 5
Type the following command:
kill -HUP ‘cat /etc/syslog.pid‘
Step 6
You are now ready to configure the log source SIEM.
To configure SIEM to receive events from a Solaris device:

From the Log Source Type drop-down list box, select the Solaris Operating
System Sendmail Logs option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your Solaris, see your vendor documentation.
Sun Solaris Basic
Security Mode
(BSM)
Sun Solaris Basic Security Mode (BSM) is an audit tracking tool for system
administrator to retrieve detailed auditing events from Sun Solaris systems. SIEM
retrieves Sun Solaris BSM events using the Log File protocol. Before you configure
SIEM to integrate with Solaris Basic Security Mode, you must:
1 Enable Solaris Basic Security Mode. For more information, see Enabling and
Configuring Solaris Basic Security Mode .
2 Convert audit logs from binary to a human-readable format. For more information,
see Converting Sun Solaris BSM Audit Logs .
3 Schedule cron to run the conversion script on a schedule. For more information,
see Creating a Cron Job .
4 Collect Sun Solaris events in SIEM using the Log File protocol. For more
information, see Pulling Data Using the Log File Protocol .
Enabling and
Configuring Solaris
Basic Security Mode
To enable Solaris Basic Security Mode and configure the classes of events to log,
perform the following steps:
Step 1
Log in to your Solaris console as a superuser or root user.
Step 2
Enable single-user mode on your Solaris console.
Step 3
Type the following command to run the bsmconv script and enable auditing:
/etc/security/bsmconv