Enterasys Security Information and Event Manager, Configuration Manual

Page: 96 / 426

You are now ready to configure the log source in SIEM.
SIEM automatically detects syslog events from your EMC VMWare server.
However, if you want to manually configure SIEM to receive events from your
VMWare ESX server:

From the Log Source Type drop-down list box, select EMC VMWare .
Configuring the
VMWare Protocol
When configuring the EMC VMWare DSM to use the VMWare protocol, we
recommend you create a user who is a member of the root group for SIEM, but
provide the user with an assigned role of read-only permissions. This ensures that
the VMWare virtual environment collects events using the VMWare protocol and
maintains a level of security for the new SIEM user you are adding.
To integrate EMC VMWare with SIEM, you must:
1 Create an ESX account for SIEM. For more information, see Creating an ESX
Account for SIEM .
2 Configure account permissions for the SIEM user. For more information, see
Configuring Account Permissions .
3 Configure the VMWare protocol in SIEM. For more information, see Configuring
SIEM .
CAUTION
Creating a user who is not part of the root or an administrative group may lead to
some events not being collected by SIEM. We recommend adding your SIEM
user to an administrative group, but assign a read-only role.
Creating an ESX
Account for SIEM
To create a SIEM user account for EMC VMWare:
Step 1
Log in to your ESX host using the vSphere Client.
Step 2
Click the Local Users & Groups tab.
Step 3
Click Users .
A list of user accounts is displayed.
Step 4
Right-click and select Add .
The Add New User window is displayed.
Step 5
Configure the following parameters:
a
Login - Type a login name for the new user.
b
UID - Optional. Type a user ID.
c
User Name - Optional. Type a user name for the account.
d
Password - Type a password for the account.
e
Confirm Password - Type the password again as confirmation.
f
Group - From the Group drop-down list box, select root .