Enterasys Security Information and Event Manager, Configuration Manual

Page: 71 / 426

Configuring DSMs
Cisco ACS 55
Step 7
Enable timestamp on log messages:
service timestamp log datatime
Step 8
Return to privileged EXEC mode:
end
Step 9
View your entries:
show running-config
Step 10
Save your entries in the configuration file:
copy running-config startup-config
Step 11
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cisco ACS device:

From the Log Source Type drop-down list box, select Cisco Aironet .
For more information on configuring log sources, see the Log Sources User Guide .
For more information about Cisco Aironet, see your vendor documentation.
Cisco ACS
A SIEM Cisco ACS DSM accepts syslog ACS events using syslog. SIEM records
all relevant and available information from the event. You can integrate Cisco ACS
with SIEM using one of the following methods:
•
Configure your Cisco ACS device to directly send syslog to SIEM (Cisco ACS
software version 4.1 and later). See
Configuring Syslog for Cisco ACS .
•
A server using the SIEM Adaptive Log Exporter (Cisco ACS software version
3.x or later). See
Configuring Cisco ACS for the Adaptive Log Exporter .
Configuring Syslog
for Cisco ACS
To configure an ACS device in SIEM, you must:
Step 1
Log in to your Cisco ACS device user interface.
Step 2
In the navigation bar, click System Configuration .
The System Configuration page opens.
Step 3
Click Logging .
The logging configuration is displayed.
Step 4
In the Syslog column for Failed Attempts , click Configure .
The Enable Logging window is displayed.
Step 5
Select the Log to Syslog Failed Attempts report check box.
Step 6
Add the following Logged Attributes:
• Message-Type
• User-Name