Enterasys Security Information and Event Manager, Configuration Manual

Page: 388 / 426

Configuring DSMs
372 T
REND
M
ICRO
g
Click Save.
Step 7
You are now ready to configure the log sources in SIEM.
To configure the Trend Micro Office Scan device:
Step 1
From the Log Source Type drop-down list box, select the Trend Micro Office
Scan option.
Step 2
From the Protocol Configuration drop-down list box, select the SNMPv2 option.
For more information on configuring log sources, see the Log Sources User Guide .
Integrating a Trend
Micro Office Scan
10.x Device
Before you configure SIEM to integrate with a Trend Micro Office Scan 10.x
device, you must:
Step 1
Integrate a Trend Micro Office Scan 10.x device with SIEM. See Configuring
General Settings .
Step 2
Configure standard notifications. See Configuring Standard Notifications .
Step 3
Configure outbreak criteria and alert notifications. See Configuring Outbreak
Criteria and Alert Notifications .
Configuring General
Settings
To integrate a Trend Micro Office Scan 10.x device with SIEM:
Step 1
Log in to the Office Scan Administration interface.
Step 2
Select Notifications > Administrator Notifications > General Settings .
Step 3
Configure the General Settings for SNMP Traps:
a
In the Server IP Address field, type the IP address of the SIEM system.
b
Type a community name for your Office Scan device.
c
Click Save .
You must now configure the Standard Notifications for Office Scan. See
Configuring Standard Notifications .
Configuring Standard
Notifications
To configure standard notifications:
Step 1
Select Notifications > Administrator Notifications > Standard Notifications .
Step 2
Define the Criteria settings.
a
Click the Criteria tab.
b
Select the option to alert administrators on the detection of virus/malware and
spyware/grayware, or when the action on these security risks is unsuccessful.
Step 3
To enable notifications:
a
Configure the SNMP Trap tab.
b
Select the Enable notification via SNMP Trap check box.