Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 137 / 426

Configuring DSMs
29 G
ENERIC
A
UTHORIZATION
S
ERVER
A SIEM generic authorization server DSM accepts events using syslog. SIEM
records all relevant events.
Before you configure SIEM to integrate with generic authorization server, you
must:
Step 1
Forward all authentication server logs to your SIEM system.
For information on forwarding authentication server logs to SIEM, see your generic
authorization server vendor documentation.
Step 2
Open the following file:
/opt/qradar/conf/genericAuthServer.conf
Make sure you copy this file to systems hosting the Event Collector and the
Console.
Step 3
Restart the Tomcat server:
service tomcat restart
A message is displayed indicating that the Tomcat server has restarted.
Step 4
Enable or disable regular expressions in your patterns by setting the
regex_enabled property accordingly. By default, regular expressions are disabled.
For example:
regex_enabled=false
When you set the regex_enabled property to false, the system generates regular
expressions (regex) based on the tags you entered while attempting to retrieve the
corresponding data values from the logs.
When you set the regex_enabled property to true, you can define custom regex to
control patterns. These regex are directly applied to the logs and the first captured
group is returned. When defining custom regex patterns, you must adhere to regex
rules, as defined by the Java programming language. For more information, see
the following website: http://download.oracle.com/javase/tutorial/essential/regex/
To integrate the generic authorization server with SIEM, make sure you specify the
classes directly instead of using the predefined classes. For example, the digit
class
(/\d/)
becomes
/[0-9]/
. Also, instead of using numeric qualifiers,
re-write the expression to use the primitive qualifiers
(/?/,/*/ and /+/)
.
Step 5
Review the file to determine a pattern for successful login: