Enterasys Security Information and Event Manager, Configuration Manual

Page: 77 / 426

Configuring DSMs
Cisco CSA 61
set logging timestamp enable
Step 4
Type the IP address of the SIEM server:
set logging server <IP address>
Step 5
Limit messages that are logged by selecting a severity level:
set logging server severity <server severity level>
Step 6
Configure the facility level that should be used in the message. The default is
local7 .
set logging server facility <server facility parameter>
Step 7
Enable the switch to send syslog messages to the SIEM server.
set logging server enable
Step 8
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cisco CatOS device:

From the Log Source Type drop-down list box, select the Cisco CatOS for
Catalyst Switches option.
For more information on configuring log sources, see the Log Sources User Guide .
Cisco CSA
You can integrate a Cisco Security Agent (CSA) server with SIEM. The Cisco CSA
DSM accepts events using syslog, SNMPv1, and SNMPv2. SIEM records all
configured Cisco CSA alerts.
Before you configure SIEM to integrate with a CSA server, you must:
Step 1
Open the Cisco CSA user interface.
Step 2
Select Events > Alerts .
Step 3
Click New .
The Configuration View window is displayed.
Step 4
Type in values for the following parameters:
a
Name - Type a name you wish to assign to your configuration.
b
Description - Type a description for the configuration. This parameter is
optional.
Step 5
From the Send Alerts , select the event set from the list box to generate alerts.
Step 6
Select the SNMP check box.
Step 7
Type a Community name.
The Community name entered in the CSA user interface must match the
Community field configured on SIEM. This option is only available using the
SNMPv2 protocol.
Step 8
In the Manager IP address parameter, type the IP address of SIEM.