Enterasys Security Information and Event Manager, Configuration Manual

Page: 43 / 426

Configuring DSMs
Custom Format Addition Key-Value Pairs 27
For more information about configuring syslog, see your Bluecoat SG vendor
documentation.
Custom Format
Addition Key-Value
Pairs
The custom format allows you to forward specific Blue Coat data or events to SIEM
using the Extended Log File Format (ELFF). The custom format is a series of pipe
delimited fields starting with
Bluecoat|
and containing
$(Blue Coat ELFF
Parameter)
. Custom format fields for SIEM must be separated by the pipe
character.
For example:
Bluecoat|src=$(c-ip)|srcport=$(c-port)|dst=$(cs-uri-address)|ds
tport=$(cs-uri-port)|username=$(cs-username)|devicetime=$(gmtti
me)|s-action=$(s-action)|sc-status=$(sc-status)|cs-method=$(cs-
method)
For more information on the available Blue Coat ELFF parameters, see your Blue
Coat appliance documentation.
Table 10-1 SIEM Custom Format Examples
Blue Coat ELFF Parameter SIEM Custom Format Example
sc-bytes $(sc-bytes)
rs(Content-type) $(rs(Content-Type))