Enterasys Security Information and Event Manager, Configuration Manual

Page: 97 / 426

Configuring DSMs
Configuring the VMWare Protocol 81
Step 6
Click Add .
Step 7
Click OK .
You are now ready to set the account permission for the user you created.
Configuring Account
Permissions
For security reasons, we recommend you configure your SIEM user account as a
member of your root or admin group, but select an assigned role of read-only
permissions. This allows the SIEM user account to view and collect events using
the VMWare protocol, but prevents external changes to your ESX environment.
To configure read-only permissions:
Step 1
Click the Permissions tab.
Step 2
Right-click and select Add Permissions .
The Assign Permissions window is displayed.
Step 3
On the Users and Groups window, click Add .
The Select Users and Groups window is displayed.
Step 4
Select your SIEM user and click Add .
Step 5
Click OK .
The Add Permissions window is displayed.
Step 6
From the Assigned Role drop-down list box, select Read-only .
Step 7
Click OK .
You are now ready to configure SIEM to receive EMC VMWare events.
Configuring SIEM To configure SIEM to receive EMC VMWare events:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
On the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
From the Log Source Type drop-down list box, select EMC VMWare .
Step 7
Using the Protocol Configuration drop-down list box, select EMC VMWare .
The VMWare protocol configuration is displayed.
Step 8
Configure the following values: