Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 139 / 426

Configuring DSMs
123
For example, if your authentication server generates the following log message:
Jun 27 12:11:21 expo sshd[19926]: Accepted password for root
from 10.100.100.109 port 1727 ssh2
The pattern for source IP address is
from
and the pattern for source port is
port
.
Step 12
Add an entry to the file for source IP address and source port:
source_ip_pattern=<source IP pattern>
source_port_pattern=<source port pattern>
Where
<source IP pattern>
and
<source port pattern>
are the patterns
identified in Step 11 for source IP address and source port.
For example:
source_ip_pattern=from
source_port_pattern=port
Step 13
Review the file to determine if a pattern exists for username.
For example:
Jun 27 12:11:21 expo sshd[19926]: Accepted password for root
from 10.100.100.109 port 1727 ssh2
The pattern for username is
for
.
Step 14
Add an entry to the file for the username pattern:
For example:
user_name_pattern=for
Step 15
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a generic authorization server:

From the Log Source Type drop-down list box, select the Configurable
Authentication message filter option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your firewall, see your vendor documentation.