Enterasys Security Information and Event Manager, Configuration Manual

Page: 52 / 426

Configuring DSMs
36 CA T
ECHNOLOGIES
You are now ready to configure the log source and log file protocol in SIEM:
To configure SIEM to receive events from the CA ACF2:
Step 1
From the Log Source Type drop-down list box, select the CA ACF2 option.
Step 2
From the Protocol Configuration drop-down list box, select the Log File protocol
option.
Step 3
Configure the log file protocol options.
For more information on configuring log sources and protocols, see the Log
Sources User Guide .
CA Top Secret
The CA Top Secret DSM allows you to integrate with an IBM zOS mainframe to
collect events and audit transactions. SIEM records all relevant and available
information from the event.
To integrate CA Top Secret events into SIEM:
1
The IBM mainframe records all security events as Service Management
Framework (SMF) records in a live repository.
2
At midnight, the CA Top Secret data is extracted from the live repository using the
SMF dump utility. The SMF file contains all of the events and fields from the
previous day in raw SMF format.
3
The
qextopsloadlib
program pulls data from the SMF formatted file. The
qextopsloadlib
program only pulls the relevant events and fields for SIEM and
writes that information in a condensed format for SIEM compatibility. The
information is saved in a location accessible by SIEM.
4
SIEM uses the log file protocol source to retrieve the output file information for
SIEM on a scheduled basis. SIEM then imports and processes this file.
This document includes:
• Configuring CA Top Secret to Integrate with SIEM
• Pulling Data Using Log File Protocol
Configuring CA Top
Secret to Integrate
with SIEM
To integrate CA Top Secret with SIEM:
Step 1
From the Enterasys Extranet website, download the following compressed file:
qextops_bundled.tar.gz
Step 2
On a Linux-based operating system, extract the file:
tar -zxvf qextops_bundled.tar.gz
The following files are contained in the archive:
qextops_jcl.txt