Enterasys Security Information and Event Manager, Configuration Manual

Page: 91 / 426

Configuring DSMs
17 C
YBER
-A
RK
V
AULT
The SIEM Cyber-Ark Vault DSM accepts events using the Log Enhanced Event
Protocol (LEEF). SIEM records both user activities and safe activities from the
Cyber-Ark Vault in the audit log events. Cyber-Ark Vault integrates with SIEM to
forward audit logs using syslog to create a complete audit picture of privileged
account activities in SIEM. Before configuring a Cyber-Ark Vault device in SIEM,
you must configure your device to send events to SIEM.
To integrate the device with SIEM:
Step 1
Log in to the Cyber-Ark device.
Step 2
Open the file DBParm.ini.
Step 3
Configure the following parameters:
•
SyslogServerIP - Type the IP address of SIEM.
• SyslogServerPort - Type the UDP port used to connect to SIEM. The default
value is 514.
• SyslogMessageCodeFilter - Configure which message codes are sent from
the Cyber-Ark Vault to SIEM. You can define specific message numbers or a
range of numbers. By default, all message codes are sent for user activities and
safe activities.
For example, to define a message code of 1,2,3,30 and 5-10, you must type:
1,2,3,5-10,30
.
•
SyslogTranslatorFile - Type the file path to the LEEF.xsl translator file. The
translator file is used to parse Cyber-Ark audit records data in the syslog
protocol.
Step 4
Copy LEEF.xsl to the location specified by the SyslogTranslatorFile parameter in
the DBParm.ini file.
Step 5
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Cyber-Ark Vault device:

From the Log Source Type drop-down list box, select Cyber-Ark Vault from
the Log Source Type option. For more information on configuring log
sources, see the Log Sources User Guide .
For more information on Cyber- Ark Vault, see your vendor documentation.