Enterasys Security Information and Event Manager, Configuration Manual

Page: 368 / 426

Configuring DSMs
352 S
YBASE
ASE
union select audit_event_name(event) as event_name, * from
sysaudits_03,
union select audit_event_name(event) as event_name, * from
sysaudits_04
Step 6
You are now ready to configure the log source SIEM.
To configure SIEM to receive events from a Sybase ASE device:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 1
From the Log Source Type drop-down list box, select the Sybase ASE option.
Step 2
Using the Protocol Configuration drop-down list box, select JDBC .
The JDBC protocol configuration is displayed.
Step 3
Update the JDBC configuration to include the following values:
a
Database Name:
sybsecurity
b
Port:
5000
(Default)
c
Username:
sa
d
Table Name:
audit_view
e
Compare Field:
eventtime
The Database Name and Table Name parameters are case sensitive.
For more information on configuring log sources and protocols, see the Log
Sources User Guide . For more information about the Sybase ASE device, see
your vendor documentation.