Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 156 / 426

Configuring DSMs
140 IBM
Step 8
Click Save .
Step 9
On the Admin tab, click Deploy Changes .
For more information on configuring log sources, see the Log Sources User Guide .
NOTE
A SIEM IBM Proventia Management SiteProtector DSM can accept detailed
SiteProtector events by combining the information obtained from the primary
(SensorData1) table with related information from the table SensorDataAVP1 and
SensorDataResponse1. The SensorData1, SensorDataAVP1 and
SensorDataReponse1 tables are located in the IBM Proventia Management
SiteProtector database. Selecting the
JDBC - SiteProtector option from the
Protocol Configuration drop-down list box enables detailed payload information.
SensorData1 remains the primary table being monitored, however, the
SiteProtectorJDBC protocol obtains additional information from the
SensorDataAVP1 table using the SensorDataID field as the key.
For more information about your SiteProtector device, see your vendor
documentation.
IBM ISS Proventia
A SIEM IBM ISS Proventia DSM accepts IBM Proventia events using SNMP. SIEM
records all relevant events. Before you configure SIEM to integrate with IBM
Proventia, you must:
Step 1
In the Proventia Manager user interface navigation pane, expand the System
node.
Step 2
Select System .
Polling Interval Type the polling interval, which is the amount of time between
queries to the event table. The default polling interval is 10
seconds.
You may define a longer polling interval by appending H for hours
or M for minutes to the numeric value. The maximum polling
interval is 1 week in any time format. Numeric values without an H
or M designator poll in seconds.
Use Named Pipe
Communication If you select MSDE as the Database Type, select the check box to
use an alternative method to a TCP/IP port connection.
When using a Named Pipe connection, the username and
password must be the appropriate Windows authentication
username and password and not the database username and
password. Also, you must use the default Named Pipe.
Database
Cluster Name If you select the Use Named Pipe Communication check box, the
Database Cluster Name parameter is displayed. If you are running
your SQL server in a cluster environment, define the cluster name
to ensure Named Pipe communication functions properly.
Table 31-4 JDBC Parameters (continued)
Parameter Description