Enterasys Security Information and Event Manager, Configuration Manual

Page: 369 / 426

Configuring DSMs
68 S
YMANTEC
This section provides information on the following DSMs:
• Symantec Endpoint Protection
•
Symantec SGS
•
Symantec System Center
• Symantec Data Loss Prevention (DLP)
Symantec Endpoint
Protection
A SIEM Symantec Endpoint Protection DSM accepts events using syslog. SIEM
records all Audit and Security log events. Before configuring a Symantec Endpoint
Protection device in SIEM, you must configure your device to send syslog events
to SIEM.
To integrate a Symantec Endpoint Protection DSM with SIEM:
Step 1
Log in to the Symantec Endpoint Protection Manager
Step 2
On the left panel, click the Admin icon.
The View Servers option is displayed.
Step 3
From the bottom of the View Servers panel, click Servers .
Step 4
From the View Servers panel, click Local Site .
Step 5
From the Tasks panel, click Configure External Logging .
Step 6
In the Generals tab:
a
Select the Enable Transmission of Logs to a Syslog Server check box.
b
In the Syslog Server field, type the IP address of the SIEM host you want to
parse the logs.
c
In the UDP Destination Port field, type 514 .
d
In the Log Facility field, type 6 .
Step 7
In the Log Filter tab:
a
Under the Management Server Logs, select the Audit Logs check box.
b
Under the Client Log panel, select the Security Logs check box.
c
Under the Client Log panel, select the Risks check box.