Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 110 / 426

Configuring DSMs
94 E
NTERASYS
To configure SIEM to receive events from an Enterasys XSR Security Router:

From the Log Source Type drop-down list box, select Enterasys XSR
Security Routers.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your Enterasys XSR Security Router, see your vendor
documentation.
Enterasys Matrix
Router
A SIEM Enterasys Matrix Router DSM accepts Enterasys Matrix events using
SNMPv1, SNMPv2, SNMPv3, and syslog. You can integrate Enterasys Matrix
Router version 3.5 with SIEM. SIEM records all SNMP events and syslog login,
logout, and login failed events. Before you configure SIEM to integrate with
Enterasys Matrix, you must:
Step 1
Log in to the switch/router as a privileged user.
Step 2
Type the following command:
set logging server <server number> description <description>
facility <facility> ip_addr <ip address> port <port> severity
<severity>
Where:
<server number>
is the server number 1 to 8.
<description>
is a description of the server.
<facility>
is a syslog facility, for example, local0.
<ip address> is the IP address of the server you wish to send
syslog messages.
<port>
is the default UDP port that the client uses to send messages to the
server. Use port 514 unless otherwise stated.
<severity>
is the server severity level 1 to 9 where 1 indicates an emergency
and 8 is debug level.
For example:
set logging server 5 description ourlogserver facility local0
ip_addr 1.2.3.4 port 514 severity 8
Step 3
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from an Enterasys Matrix device:

From the Log Source Type drop-down list box, select Enterasys Matrix E1
Switch.
For more information on configuring log sources, see the Log Sources User Guide .
For more information, see your vendor documentation.