Enterasys Security Information and Event Manager, Configuration Manual

Page: 371 / 426

Configuring DSMs
Symantec System Center 355
dbo.actualaction.Actualaction AS [action],
dbo.alerts.Alertdatetime AS [date],
dbo.clientuser.Clientuser AS user_name FROM
dbo.alerts INNER JOIN
dbo.virus ON dbo.alerts.Virusname_Idx =
dbo.virus.Virusname_Idx INNER JOIN
dbo.inventory ON dbo.alerts.Computer_Idx =
dbo.inventory.Computer_Idx INNER JOIN
dbo.actualaction ON dbo.alerts.Actualaction_Idx =
dbo.actualaction.Actualaction_Idx INNER JOIN
dbo.clientuser ON dbo.alerts.Clientuser_Idx =
dbo.clientuser.Clientuser_Idx
Once you have created your custom view, you must configure SIEM to receive
event information using the JDBC protocol.
To configure Symantec System Center (SSC) DSM with SIEM, see Configuring
SIEM to Receive Events .
Configuring SIEM to
Receive Events
To configure SIEM to access the SSC database using the JDBC protocol:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
Using the Log Source Type drop-down list box, select Symantec System Center .
Step 7
Using the Protocol Configuration drop-down list box, select JDBC .
Step 8
Configure the following: