Enterasys Security Information and Event Manager, Configuration Manual

Page: 89 / 426

Configuring DSMs
16 CRYPTOC
ARD
CRYPTO-S
HIELD
The SIEM CRYPTOCard CRYPTO-Shield DSM accepts events using syslog.
SIEM records all relevant events. Before configuring a CRYPTOCard
CRYPTO-Shield device in SIEM, you must configure your device to send syslog
events to SIEM.
To configure the device to send syslog events to SIEM, you must:
Step 1
Configure the following System Configuration parameters:
NOTE
You must have CRYPTOCard Operator access with the assigned default
Super-Operator system role to access the System Configuration parameters.
•
log4j.appender.<protocol>
- Directs the logs to a syslog host where the
<protocol>
is the type of log appender, which determines where you want to
send logs for storage. The options are: ACC, DBG, or LOG. For this parameter,
type the following:
org.apache.log4j.net.SyslogAppender
•
log4j.appender.<protocol>.SyslogHost <IP address>
- Type the IP
address or hostname of the syslog server where:
-
<protocol>
is the type of log appender, which determines where you want
to send logs for storage. The options are: ACC, DBG, or LOG.
-
<IP address>
is the IP address of the SIEM host to which you want to send
logs. This value can only be specified when the first parameter is configured.
This parameter can only be specified when the log4j.apender.<protocol>
parameter is configured.
Step 2
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a CRYPTOCard CRYPTO-Shield
device:

From the Log Source Type drop-down list box, select the CRYPTOCard
CRYPTOShield option. For more information on configuring log sources, see
the Log Sources User Guide .
For more information about your CRYPTOCard CRYPTO-Shield device, see your
vendor documentation.