Enterasys Security Information and Event Manager, Configuration Manual

Page: 73 / 426

Configuring DSMs
Cisco ASA 57
Step 6
Add the following Logged Attributes:
• Message-Type
•
User-Name
•
Nas-IP-Address
• Authen-Failure-Code
• Caller-ID
•
NAS-Port
•
Author-Data
• Group-Name
• Filter Information
•
Logged Remotely
Step 7
Configure a time frame for Cisco ACS to generate a new csv file.
Step 8
Click Submit .
Step 9
You are now ready to configure the log source in SIEM.
You can integrate your Cisco ACS with SIEM using the SIEM Adaptive Log
Exporter. The Adaptive Log Exporter reads the csv files in the Cisco ACS root log
directory and forwards the events to SIEM using syslog. For more information on
using the Adaptive Log Exporter, see the
Adaptive Log Exporter Users Guide .
If you are not using the Adaptive Log Exporter, SIEM automatically detects the
Cisco ACS events from the Adaptive Log Exporter. However, if you want to
manually configure SIEM to receive events from Cisco ACS:

From the Log Source Type drop-down list box, select the Cisco ACS option.
For more information on configuring log sources, see the Log Sources User
Guide .
For more information about Cisco ACS, see your vendor documentation.
Cisco ASA
You can integrate a Cisco Adaptive Security Appliance (ASA) with SIEM. A Cisco
ASA DSM accepts events using syslog or NetFlow using NetFlow Security Event
Logging (NSEL). SIEM records all relevant events. Before you configure SIEM,
you must configure your Cisco ASA device to forward syslog or NetFlow NSEL
events to SIEM.
Choose one of the following options:
•
Forward events to SIEM using syslog. See Integrating Cisco ASA Using Syslog
•
Forward events to SIEM using NetFlow NSEL. See Integrating Cisco ASA for
NetFlow using NSEL