Enterasys Security Information and Event Manager, Configuration Manual

Page: 395 / 426

Configuring DSMs
75 U
NIVERSAL
DSM
SIEM collects and correlates events from network infrastructure and security
devices. Once the events are collected and before the correlation can begin, the
individual events from these devices must be properly parsed to determine the
event name, IP addresses, protocol, and ports. For common network devices
(such as, NetScreen Firewalls) predefined DSMs have been engineered into SIEM
to properly parse all event messages from the respective devices. Once the events
from a device have been parsed by the DSM, SIEM can continue to correlate
events into offenses.
If an enterprise network has one or more network or security devices that are not
officially supported (no specific DSM for the device exists), you can use the
Universal DSM. The Universal DSM allows you to forward events and messages
from unsupported devices to SIEM for correlation. SIEM integrates with many
common protocol sources using the Universal DSM.
For more information about log source protocols, see the Log Sources User Guide .
To configure the Universal DSM, you must use device extensions to associate a
Universal DSM to devices. Before you define device extension information using
the log sources window in the Admin tab, you must create an extensions document
for the log source. For information about device extensions, see the
Log Sources
User Guide .