Enterasys Security Information and Event Manager, Configuration Manual

Page: 78 / 426

Configuring DSMs
62 C
ISCO
Step 9
Click Save .
For more information on forwarding logs to SIEM, see your vendor documentation.
Step 10
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cisco CSA device:

From the Log Source Type drop-down list box, select Cisco CSA .
For more information on configuring log sources, see the Log Sources User Guide .
Cisco FWSM
You can integrate Cisco Firewall Service Module (FWSM) with SIEM. A SIEM
FWSM DSM accepts FWSM events using syslog. SIEM records all relevant Cisco
FWSM events.
Before you configure SIEM to integrate with Cisco FWSM, you must configure
Cisco FWSM to forward logs to SIEM:
Step 1
Using a Console connection, telnet, or SSH, log in to the Cisco FWSM.
Step 2
Enable logging:
logging on
Step 3
Change the logging level:
logging trap level (1-7)
By default, the logging level is set to 3 (error).
Step 4
Designate SIEM as a host to receive the messages:
logging host [interface] ip_address [tcp[/port] | udp[/port]]
[format emblem]
For example:
logging host dmz1 192.168.1.5
Where 192.168.1.5 is the IP address of your SIEM system.
Step 5
You are now ready to configure the log source SIEM.
To configure SIEM to receive events from a Cisco IDS device:

From the Log Source Type drop-down list box, select the Cisco Firewall
Services Module (FWSM) option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about Cisco FWSM devices, see your Cisco documentation.
Cisco IDS/IPS
A Cisco IDS/IPS DSM polls the Cisco IDS/IPS events using the Security Device
Event Exchange (SDEE) protocol. SDEE specifies the message format and the
protocol used to communicate the events generated by security devices. SIEM