Enterasys Security Information and Event Manager, Configuration Manual

Page: 375 / 426

Configuring DSMs
Symantec Data Loss Prevention (DLP) 359
Step 8
On the Conditions panel, select the following conditions:
• From the first drop-down list box, select Protocol or Endpoint Monitoring .
•
From the second drop-down list box, select Is Any Of .
•
From the third drop-down list box, select SMTP .
Step 9
On the Actions panel, click Add Action .
Step 10
From the Actions drop-down list box, select All: Log to a Syslog Server .
The Log to a Syslog Server actions are displayed.
Step 11
Configure the following options:
a
Host - Type the IP address of SIEM or an Event Collector.
b
Port - Type 514 as the syslog port.
c
Message -Type the following string to add a message for SMTP events.
LEEF:1.0|Symantec|DLP|2:medium|$POLICY$|suser=$SENDER$|duser=
$RECIPIENTS$|rules=$RULES$|matchCount=$MATCH_COUNT$|blocked=$
BLOCKED$|incidentID=$INCIDENT_ID$|incidentSnapshot=$INCIDENT_
SNAPSHOT$|subject=$SUBJECT$|fileName=$FILE_NAME$|parentPath=$
PARENT_PATH$|path=$PATH$|quarantineParentPath=$QUARANTINE_PAR
ENT_PATH$|scan=$SCAN$|target=$TARGET$
d
Level - From this drop-down list box, select 6 - Informational .
Step 12
Click Save .
You are now ready to configure your None Of SMTP response rule.
Creating a None Of
SMTP Response Rule
To configure a None Of SMTP response rule in Symantec DLP:
Step 1
From the menu, select the Manage > Policies > Response Rules .
Step 2
Click Add Response Rule .
The New Response Rule panel is displayed.
Step 3
Select one of the following response rule types:
•
Automated Response - Automated response rules are triggered automatically
as incidents occur. This is the default value.
•
Smart Response - Smart response rules are added to the Incident Command
screen and handled by an authorized Symantec DLP user.
Step 4
Click Next .
The Configure Response Rule panel is displayed.
Step 5
Configure the following values:
a
Rule Name - Type a name for the rule you are creating. This name should be
descriptive enough for policy authors to identify the rule. For example,
SIEM
Syslog None Of SMTP
.
b
Description - Optional. Type a description for the rule you are creating.