Enterasys Security Information and Event Manager, Configuration Manual

Page: 47 / 426

Configuring DSMs
12 CA T
ECHNOLOGIES
This section provides information on the following DSMs:
• CA ACF2
•
CA Top Secret
CA ACF2
The CA Access Control Facility (ACF2) DSM allows you to use an IBM mainframe
to collect events and audit transactions. SIEM retrieves archived log files from a
remote host using the log file protocol and records all relevant information from the
event.
To integrate CA ACF2 events into SIEM:
1
The IBM mainframe records all security events as Service Management
Framework (SMF) records in a live repository.
2
The CA ACF2 data is extracted from the live repository using the SMF dump utility.
The SMF file contains all of the events and fields from the previous day in raw SMF
format.
3
The
QexACF2.load.trs
program pulls data from the SMF formatted file. The
QexACF2.load.trs
program only pulls the relevant events and fields for SIEM
and writes that information in a condensed format for SIEM compatibility. The
information is saved in a location accessible by SIEM.
4
SIEM uses the log file protocol source to retrieve the output file information for
SIEM on a scheduled basis. SIEM then imports and processes this file.
This document includes:
• Configuring CA Top Secret to Integrate with SIEM
•
Pulling Data Using Log File Protocol
Configuring CA ACF2
to Integrate with
SIEM
To integrate CA ACF2 with SIEM:
Step 1
From the Enterasys Extranet website, download the following compressed file:
qexacf2_bundled.tar.gz
Step 2
On a Linux-based operating system, extract the file: