Enterasys Security Information and Event Manager, Configuration Manual

Page: 382 / 426

Configuring DSMs
366 T
IPPING
P
OINT
TippingPoint X505/X506 device in SIEM, you must configure your TippingPoint
device to send syslog events to SIEM. To configure the device to send system,
audit, VPN, and firewall session log events to SIEM:
Step 1
Log in to the TippingPoint X505/X506 device.
Step 2
From the LSM menu, select System > Configuration > Syslog Servers .
The Syslog Servers window is displayed.
Step 3
For each log type you want to deliver to SIEM, select the check box and type the IP
address of your SIEM system.
NOTE
If SIEM resides in a different subnet than your Tipping Point device, you may have
to add static routes. For more information, see your vendor documentation.
Step 4
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a TippingPoint X505/X506 device:

From the Log Source Type drop-down list box, select the TippingPoint X
Series Appliances option.
For more information on configuring log sources, see the Log Sources User Guide .
NOTE
If you have a previously configured TippingPoint X505/X506 DSM installed and
configured on your SIEM system, the
TippingPoint X Series Appliances option
is still displayed in the Log Source Type drop-down list box. However, any new
TippingPoint X505/X506 DSM you configure, you must select the T ippingPoint
Intrusion Prevention System (IPS) option.