Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 206 / 426

Configuring DSMs
190 L
INUX
-A INPUT -i eth0 --dport 31337 -j DENY
Step 3
Insert a matching rule immediately before each rule you want to log:
-A INPUT -i eth0 --dport 31337 -j DENY
-A INPUT -i eth0 --dport 31337 -j DENY
Step 4
Update the target of the new rule to LOG for each rule you want to log. For
example:
-A INPUT -i eth0 --dport 31337 -j LOG
-A INPUT -i eth0 --dport 31337 -j DENY
Step 5
Set the log level of the LOG target to a SYSLOG priority level, such as info or
notice:
-A INPUT -i eth0 --dport 31337 -j LOG --log-level info
-A INPUT -i eth0 --dport 31337 -j DENY
Step 6
Add a string to the file to identify the rule’s subsequent behavior. Set the log prefix
parameter to
Q1Target=<rule>.
Where
<rule>
is one of fw_accept, fw_drop, or fw_reject.
For example, if the rule being logged targets DENY, the log prefix setting should be
Q1Target=fw_deny.
-A INPUT -i eth0 --dport 31337 -j LOG --log-level info
--log-prefix "Q1Target=fw_deny "
-A INPUT -i eth0 --dport 31337 -j DENY
NOTE
The trailing space is required before the closing quotation mark.
Step 7
Save and exit the file.
Step 8
Restart IPtables:
/etc/init.d/iptables restart
Step 9
Open the
syslog.conf
file.
Step 10
Add the following line:
kern.<log level> @<IP address>
Where:
<log level>
is the previously set log level.
<IP address>
is the IP address of SIEM.
Step 11
Save and exit the file.
Step 12
Restart the syslog daemon:
/etc/init.d/syslog restart
Step 13
You are now ready to configure the log source in SIEM.