Enterasys Security Information and Event Manager, Configuration Manual

Page: 87 / 426

Configuring DSMs
15 C
ITRIX
N
ET
S
CALER
A SIEM Citrix NetScaler DSM accepts events using syslog. SIEM records all
relevant audit log events from Citrix NetScaler.
Before you configure SIEM to integrate with Citrix NetScaler, you must:
Step 1
Log in to your Citrix NetScaler device as a root user.
Step 2
Type the following command to add a remote syslog server:
add audit syslogAction <ActionName> <IP Address> -serverPort 514
-logLevel Info -dateFormat DDMMYYYY
Where:
<ActionName>
is a descriptive name for the syslog server action.
<IP Address>
is the IP address or hostname of your SIEM system.
For example:
add audit syslogAction action-SIEM 10.10.10.10 -serverPort 514
-logLevel Info -dateFormat DDMMYYYY
Step 3
Type the following command to add an audit policy:
add audit syslogPolicy <PolicyName> <Rule> <ActionName>
Where:
<PolicyName>
is a descriptive name for the syslog policy.
<Rule>
is the rule or expression the policy uses. The only supported value is
ns_true
.
<ActionName>
is a descriptive name for the syslog server action.
For example:
add audit syslogPolicy policy-SIEM ns_true action-SIEM
Step 4
Type the following command to bind the policy globally:
bind system global <PolicyName> -priority <Integer>
Where:
<PolicyName>
is a descriptive name for the syslog policy.
<Integer>
is a numeric value used to rank message priority for multiple policies
that are communicating using syslog.