Enterasys Security Information and Event Manager, Configuration Manual

Page: 370 / 426

Configuring DSMs
354 S
YMANTEC
Step 8
Click OK .
Step 9
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Symantec Endpoint Protection device:

From the Log Source Type drop-down list box, select the Symantec
Endpoint Protection option.
For more information on configuring log sources, see the Log Sources User Guide .
Symantec SGS
A SIEM Symantec Gateway Security (SGS) Appliance DSM accepts SGS events
using syslog. SIEM records all relevant events from SGS. Before you configure
SIEM to integrate with an SGS, you must configure syslog within your SGS
appliance. For more information on Symantec SGS, see your vendor
documentation.
Once you configure syslog to forward events to SIEM, you are ready to configure
the log source in SIEM.
To configure SIEM to receive events from your SGS appliance:

From the Log Source Type drop-down list box, select the Symantec
Gateway Security (SGS) Appliance option.
For more information on configuring devices, see the Log Sources User Guide.
Symantec System
Center
A SIEM Symantec System Center (SSC) DSM retrieves events from an SSC
database using a custom SIEM view. SIEM records all SSC events. You must
configure the SSC database with a user that has read and write privileges for the
custom SIEM view, which reports the correct information to SIEM. Symantec
System Center (SSC) only supports the JDBC protocol.
To integrate an SSC DSM with SIEM:
Step 1
In the Microsoft SQL Server database used by the SSC device, configure a custom
default view to support SIEM:
The database name must not contain any spaces.
CREATE VIEW dbo.vw_SIEM AS SELECT
dbo.alerts.Idx AS idx,
dbo.inventory.IP_Address AS ip,
dbo.inventory.Computer AS computer_name,
dbo.virus.Virusname AS virus_name,
dbo.alerts.Filepath AS filepath,
dbo.alerts.NoOfViruses AS no_of_virus,