Enterasys Security Information and Event Manager, Configuration Manual

Page: 374 / 426

Configuring DSMs
358 S
YMANTEC
Step 10
On the Admin tab, click Deploy Changes .
SIEMFor information on configuring the JDBC protocol, see the Log Sources User
Guide.
Symantec Data
Loss Prevention
(DLP)
A SIEM Symantec Data Loss Protection (DLP) DSM accepts events from a
Symantec DLP appliance using syslog. Before configuring SIEM, you must
configure response rules on your Symantec DLP. The response rule allows the
Symantec DLP appliance to forward syslog events to SIEM when a data loss policy
violation occurs. Integrating Symantec DLP requires you to create two protocol
response rules (SMTP and None of SMTP) for SIEM. These protocol response
rules create an action to forward the event information, using syslog, when an
incident is triggered.
To configure Symantec DLP with SIEM, you must:
1 Create an SMTP response rule. For more information, see Creating an SMTP
Response Rule .
2 Create a None of SMTP response rule. For more information, see Creating a None
Of SMTP Response Rule .
3 Configure SIEM. For more information, see Configuring SIEM with Symantec DLP .
Creating an SMTP
Response Rule
To configure an SMTP response rule in Symantec DLP:
Step 1
Log in to your Symantec DLP user interface.
Step 2
From the menu, select the Manage > Policies > Response Rules .
Step 3
Click Add Response Rule .
The New Response Rule panel is displayed.
Step 4
Select one of the following response rule types:
• Automated Response - Automated response rules are triggered automatically
as incidents occur. This is the default value.
• Smart Response - Smart response rules are added to the Incident Command
screen and handled by an authorized Symantec DLP user.
Step 5
Click Next .
The Configure Response Rule panel is displayed.
Step 6
Configure the following values:
a
Rule Name - Type a name for the rule you are creating. This name should be
descriptive enough for policy authors to identify the rule. For example,
SIEM
Syslog SMTP
.
b
Description - Optional. Type a description for the rule you are creating.
Step 7
Click Add Condition .