Enterasys Security Information and Event Manager, Configuration Manual

Page: 84 / 426

Configuring DSMs
68 C
ISCO
set logging server facility server_facility_parameter
set logging server severity server_severity_level
Step 5
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cisco VPN Concentrator device:

From the Log Source Type drop-down list box, select Cisco VPN 3000
Series Concentrator .
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your Cisco VPN Concentrator, see your vendor
documentation.
Cisco Wireless
Services Module
You can integrate a Cisco Wireless Services Module (WiSM) device with SIEM. A
Cisco WiSM DSM accepts events using syslog. Before you configure SIEM to
integrate with a Cisco WiSM device, you must:
Step 1
Log in to the Cisco Wireless LAN Controller user interface.
Step 2
Click Management > Logs > Config .
The Syslog Configuration window is displayed.
Step 3
In the Syslog Server IP Address field type the IP address of the SIEM host to
which you want to send the syslog messages. Click Add .
Step 4
Using the Syslog Level drop-down list box, set the severity level for filtering syslog
messages to the syslog servers using one of the following options:
• Emergencies - Severity level 0
•
Alerts - Severity level 1 (Default)
•
Critical - Severity level 2
• Errors - Severity level 3
• Warnings - Severity level 4
•
Notifications - Severity level 5
•
Informational - Severity level 6
• Debugging - Severity level 7
If you set a syslog level, only those messages whose severity level is equal or less
than that level are sent to the syslog servers. For example, if you set the syslog
level to Warnings (severity level 4), only those messages whose severity is
between 0 and 4 are sent to the syslog servers.
Step 5
From the Syslog Facility drop-down list box, set the facility for outgoing syslog
messages to the syslog server using one of the following options:
•
Kernel - Facility level 0
• User Process - Facility level 1