Enterasys Security Information and Event Manager, Configuration Manual

Page: 70 / 426

Configuring DSMs
54 C
ISCO
Step 4
Type the hostname or IP address of the destination host and port in the First
Syslog Server field. Click OK .
The system restarts with new settings. When finished, the Syslog server window
displays the host you have configured.
Step 5
Click OK .
The Syslog Configuration menu is displayed. Notice that options for editing the
server configuration, removing the server, or adding a second server are now
available.
Step 6
If you want to add another server, click Add Second Server .
At any time, click the View Syslog options to view existing server configurations.
Step 7
To return to the Advanced Menu, click Return .
Step 8
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cisco ACE Firewall device:

From the Log Source Type drop-down list box, select the Cisco ACE
Firewall option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information on forwarding logs to SIEM, see your vendor documentation.
Cisco Aironet
You can integrate a Cisco Aironet device with SIEM. A Cisco Aironet DSM accepts
Cisco Emblem Format events using syslog. Before you configure SIEM to
integrate with a Cisco Aironet device, you must:
Step 1
Establish a connection to the Cisco Aironet device using one of the following
methods”
• Telnet to the wireless access point
• Access the console
Step 2
Type the following command to access privileged EXEC mode:
enable
Step 3
Type the following command to access global configuration mode:
config terminal
Step 4
Type the following command to enable message logging:
logging on
Step 5
Configure the syslog facility. The default is local7.
logging facility <facility, for example, local7>
Step 6
Log messages to the SIEM host:
logging <IP address of your SIEM system>