Enterasys Security Information and Event Manager, Configuration Manual

Page: 63 / 426

Configuring DSMs
Check Point FireWall-1 47
NOTE
You must know if the Check Point Log Host is a separate object in your
configuration from the Check Point Management Server. In most cases, the
Check Point Log Host is the same object as the Check Point Management Server.
Step 3
Click Edit .
The Check Point Host General Properties window is displayed.
Step 4
Copy the Secure Internal Communication (SIC).
NOTE
Depending on your Check Point version, the Communication button may not be
available to display the SIC attribute. You may be required to locate the SIC
attribute from the Check Point Management Server command line interface. You
must use the
cpca_client lscert
command from the command line interface
of the Management Server to display all certificates. The Log Source SIC Attribute
resembles the following example: cn=cp_mgmt,o=cpmodule…tdfaaz. For more
information, see your Check Point Command Line Interface Guide.
You must now install the Security Policy from the Check Point SmartDashboard
user interface.
Step 5
Select Policy > Install > OK.
You are now ready to configure the OPSEC LEA protocol. See Configuring SIEM
OPSEC/LEA Parameters .
Configuring SIEM OPSEC/LEA Parameters
To configure the log source in SIEM, you must:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
From the Log Source Type drop-down list box, select Check Point FireWall-1 .
Step 7
Using the Protocol Configuration drop-down list box, select OPSEC/LEA .
The OPSEC/LEA protocol parameters appear.
Step 8
Configure the following values:
a
Log Source Name - Type a name for the log source.
a
Log Source Identifier - Type the IP address for the log source. This value must
match the value you typed in the Server IP parameter.