Enterasys Security Information and Event Manager, Configuration Manual

Page: 376 / 426

Configuring DSMs
360 S
YMANTEC
Step 6
Click Add Condition .
Step 7
On the Conditions panel, select the following conditions:
•
From the first drop-down list box, select Protocol or Endpoint Monitoring .
• From the second drop-down list box, select Is Any Of .
• From the third drop-down list box, select None Of SMTP .
Step 8
On the Actions panel, click Add Action .
Step 9
From the Actions drop-down list box, select All: Log to a Syslog Server .
The Log to a Syslog Server actions are displayed.
Step 10
Configure the following options:
a
Host - Type the IP address of SIEM or an Event Collector.
b
Port - Type 514 as the syslog port.
c
Message -Type the following string to add a message for None Of SMTP
events.
LEEF:1.0|Symantec|DLP|2:medium|$POLICY$|src=$SENDER$|dst=$REC
IPIENTS$|rules=$RULES$|matchCount=$MATCH_COUNT$|blocked=$BLOC
KED$|incidentID=$INCIDENT_ID$|incidentSnapshot=$INCIDENT_SNAP
SHOT$|subject=$SUBJECT$|fileName=$FILE_NAME$|parentPath=$PARE
NT_PATH$|path=$PATH$|quarantineParentPath=$QUARANTINE_PARENT_
PATH$|scan=$SCAN$|target=$TARGET$
d
Level - From this drop-down list box, select 6 - Informational .
Click Save .
Step 11
You are now ready to configure SIEM.
Configuring SIEM
with Symantec DLP
You are now ready to configure the log source in SIEM. SIEM automatically
detects syslog events for the SMTP and None of SMTP response rules you
created. However, if you want to manually configure SIEM to receive events from a
Symantec DLP appliance:

From the Log Source Type drop-down list box, select the Symantec DLP
option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about Symantec DLP, see your vendor documentation.