Enterasys Security Information and Event Manager, Configuration Manual

Page: 79 / 426

Configuring DSMs
Cisco IronPort 63
only supports direct SDEE connections to the device and not the management
software, which controls the device.
NOTE
You must have security access or web authentication on the device before
connecting to SIEM.
Once you configure your Cisco IDS/IPS device, you must configure the SDEE
protocol in SIEM. When configuring the SDEE protocol, you must define the URL
required to access the device.
For example,
https://www.mysdeeserver.com/cgi-bin/sdee-server
.
You must use an http or https URL, which is specific to your Cisco IDS version:
• If you are using RDEP (for Cisco IDS v4.0), the URL should have
/cgi-bin/event-server at the end. For example:
https://www.my-rdep-server.com/cgi-bin/event-server
•
If you are using SDEE/CIDEE (for Cisco IDS v5.x and above), the URL should
have /cgi-bin/sdee-server at the end. For example:
https://www.my-sdee-server/cgi-bin/sdee-server
To configure SIEM to receive events from a Cisco IDS/IPS device:

From the Log Source Type drop-down list box, select the Cisco Intrusion
Prevention System (IPS) option.
For more information on configuring devices, see the Log Sources User Guide .
For more information about your Cisco IDS/IPS, see your vendor documentation.
Cisco IronPort
A Cisco IronPort DSM integrates with SIEM to provide event information for email
spam, web content filtering, and corporate email policy enforcement. Before you
configure SIEM to integrate with your Cisco IronPort device, you must select the
log type to configure:
• To configure IronPort mail logs, see IronPort Mail Log Configuration .
•
To configure IronPort content filtering logs, see IronPort Web Content Filter .
IronPort Mail Log
Configuration
A SIEM Cisco IronPort DSM accepts events using syslog. To configure your
IronPort device to send syslog events to SIEM, you must:
Step 1
Log in to your Cisco IronPort user interface.
Step 2
Select System Administration\Log Subscriptions .
Step 3
Click Add Log Subscription .
Step 4
Configure the following values:
•
Log Type - Define a log subscription for both Ironport Text Mail Logs and
System Logs .