Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 192 / 426

Configuring DSMs
176 J
UNIPER
N
ETWORKS
c
Click New Filter .
d
Select WELF . Click Save Changes .
e
From the left pane, select System > Log/Monitoring > Client Logs >
Settings .
f
From the Select Events to Log pane, select the events that you wish to log.
g
In the Server name/IP field, type the name or IP address of the syslog server.
h
From the Facility drop-down list box, select the facility.
i
From the Filter drop-down list box, select WELF:WELF .
j
Click Add , then click Save Changes .
Step 6
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from Juniper Networks Secure Access
device:

From the Log Source Type drop-down list box, select Juniper Networks
Secure Access (SA) SSL VPN .
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your Juniper device, see your vendor documentation.
Using Syslog Format To integrate a Juniper Networks Secure Access device with SIEM using syslog:
Step 1
Log in to your Juniper device administration user interface:
https://10.xx.xx.xx/admin
Step 2
Configure syslog server information for events:
a
From the left pane, select System > Log/Monitoring > Events > Settings .
b
From the Select Events to Log section, select the events that you wish to log.
c
In the Server name/IP field, type the name or IP address of the syslog server.
Step 3
Configure syslog server information for user access:
a
From the left pane, select System > Log/Monitoring > User Access >
Settings .
b
From the Select Events to Log section, select the events that you wish to log.
c
In the Server name/IP field, type the name or IP address of the syslog server.
Step 4
Configure syslog server information for administrator access:
a
From the left pane, select System > Log/Monitoring > Admin Access >
Settings .
b
From the Select Events to Log section, select the events that you wish to log.
c
In the Server name/IP field, type the name or IP address of the syslog server.
Step 5
Configure syslog server information for client logs: