Enterasys Security Information and Event Manager, Configuration Manual

Page: 80 / 426

Configuring DSMs
64 C
ISCO
• Log Name - Type a log name.
•
File Name - Use the default configuration value.
•
Maximum File Size - Use the default configuration value.
• Log Level - Select Information (Default).
• Retrieval Method - Select Syslog Push .
•
Hostname - Type the IP address or server name of your SIEM system.
•
Protocol - Select UDP .
• Facility - Use the default configuration value. This value depends on the
configured Log Type.
Step 5
Save the subscription.
Step 6
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cisco IronPort device:

From the Log Source Type drop-down list box, select the Cisco IronPort
option.
For more information on configuring devices, see the Log Sources User Guide .
For more information about your server, see your vendor documentation.
IronPort Web Content
Filter
A SIEM Cisco IronPort DSM retrieves web content filtering events in W3C format
from a remote source using the log file protocol. Your system must be running the
latest version of log file protocol to integrate with a Cisco IronPort device. To
configure your Cisco IronPort device to push web content filter events, you must
configure a log subscription for the web content filter using the W3C format. For
more information on configuring a log subscription, see your Cisco IronPort
documentation.
You are now ready to configure the log source and protocol SIEM.
Step 1
From the Log Source Type drop-down list box, select Cisco IronPort .
Step 2
From the Protocol Configuration drop-down list box, select Log File protocol
option.
Step 3
Select W3C as the Event Generator used to process the web content filter log
files.
Step 4
The FTP File Pattern parameter must use a regular expression that matches the
log files generated by the web content filter logs.
For more information on configuring devices, see the Log Sources User Guide .
Cisco NAC
A SIEM Cisco NAC DSM accepts events using syslog. SIEM records all relevant
audit, error, and failure events as well as quarantine and infected system events.