Enterasys Security Information and Event Manager, Configuration Manual

Page: 380 / 426

Configuring DSMs
364 T
IPPING
P
OINT
c
Log Type - Select SMS 2.0 / 2.1 Syslog format from the drop-down list box.
d
Facility - Select Log Audit from the drop-down list box.
e
Severity - Select Severity in Event from the drop-down list box.
f
Delimiter - Select TAB as the delimiter for the generated logs.
g
Include Timestamp in Header - Select Use original event timestamp .
Step 7
Select the Include SMS Hostname in Header check box.
Step 8
Click OK .
Step 9
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a TippingPoint device:

From the Log Source Type drop-down list box, select the TippingPoint
Intrusion Prevention System (IPS) option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your TippingPoint device, see your vendor
documentation.
Configuring the
Notification Contacts
for LSM
To configure LSM notification contacts:
Step 1
Log in to the TippingPoint system.
Step 2
From the LSM menu, select IPS > Action Sets .
The IPS Profile - Action Sets window is displayed.
Step 3
Click the Notification Contacts tab.
Step 4
In the Contacts List , click Remote System Log .
The Edit Notification Contact page is displayed.
Step 5
Configure the following values:
a
Syslog Server - Type the IP address of the SIEM system to receive syslog
event messages.
b
Port - Type 514 as the port address.
c
Alert Facility - Select none or a numeric value 0-31 from the drop-down list
box. Syslog uses these numbers to identify the message source.
d
Block Facility - Select none or a numeric value 0-31 from the drop-down list
box. Syslog uses these numbers to identify the message source.
e
Delimiter - Select TAB from the drop-down list box.
Step 6
Click Add to table below .
Step 7
Configure a Remote system log aggregation period in minutes.