Enterasys Security Information and Event Manager, Configuration Manual

Page: 76 / 426

Configuring DSMs
60 C
ISCO
Step 9
Type the following command to define a class for the flow-export action:
class flow_export_class
Step 10
Type the following command to configure the flow-export action:
flow-export event-type all destination <IP address>
Where <IP address> is the IP address of SIEM.
NOTE
If you are using a version of Cisco ASA prior to v8.3 you may skip Step 10 as the
device defaults to the flow-export destination. For more information, see your
Cisco ASA documentation.
Step 11
Type the following command to add the service policy globally:
service-policy flow_export_policy global
Step 12
Exit the configuration:
exit
Step 13
Save the changes:
write mem
You must verify that your collector applications use the Event Time field to
correlate events.
Step 14
You are now ready to configure the log source and protocol in SIEM.
To configure SIEM to receive events from a Cisco ASA device using NetFlow:
Step 1
From the Log Source Type drop-down list box, select Cisco Adaptive Security
Appliance (ASA) .
Step 2
From the Protocol Configuration drop-down list box, select Cisco NSEL . For
more information on configuring log sources, see the Log Sources User Guide .
Step 3
Your system must be running the latest version of the NSEL protocol to integrate
with a Cisco ASA device using NetFlow NSEL.
For more information on configuring NetFlow with your Cisco ASA device, see your
vendor documentation.
Cisco CatOS for
Catalyst Switches
A SIEM Cisco CatOS for Catalyst Switches DSM accepts events using syslog.
SIEM records all relevant device events. Before configuring a Cisco CatOS device
in SIEM, you must configure your device to send syslog events to SIEM.
To configure the device to send syslog events to SIEM:
Step 1
Log in to your Cisco CatOS user interface.
Step 2
Type the following command to access privileged EXEC mode:
enable
Step 3
Configure the system to timestamp messages: