Enterasys Security Information and Event Manager, Configuration Manual

Page: 399 / 426

Configuring DSMs
77 W
EBSENSE
V-S
ERIES
This section provides information on the following DSMs:
• Websense V-Series Data Security Suite
•
Websense V-Series Content Gateway
Websense V-Series
Data Security Suite
The SIEM Websense V-Series Data Security Suite DSM supports Websense
V-Series appliances and the Data Security Suite (DSS) software. The SIEM
Websense V-Series Data Security Suite DSM accepts events using syslog. Before
you can integrate SIEM you must enable the Websense V-Series appliance to
forward syslog events in the Data Security Suite (DSS) Management Console.
To enable syslog forwarding in the DSS Management Console:
Step 1
Select Policies > Policy Components > Notification Templates .
Step 2
Select an existing Notification Template or create a new template.
Step 3
Click the General tab.
Step 4
Click Send Syslog Message .
Step 5
Select Options > Settings > Syslog to access the Syslog window.
The syslog window enables administrators to define the IP address/hostname and
port number of the syslog in their organization. The defined syslog receives
incident messages from the Websense Data Security Suite DSS Manager.
Step 6
The syslog is composed of the following fields:
DSS Incident|ID={value}|action={display value - max}|urgency=
{coded}|policy categories={values,,,}|source={value-display
name}|destinations={values...}|channel={display name}|matches=
{value}|detaills={value}
• Max length for policy categories is 200 characters.
•
Max length for destinations is 200 characters.
•
Details and source are reduced to 30 characters.
Step 7
Click Test Connection to verify that your syslog is accessible.
Step 8
You are now ready to configure the log source in SIEM.