Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 212 / 426

Configuring DSMs
196 M
C
A
FEE
Authentication
Domain If you select MSDE as the Database Type and the database is
configured for Windows, you must define the Window
Authentication Domain. Otherwise, leave this parameter blank.
Database
Instance Optional. Type the database instance, if you have multiple SQL
server instances on your database server.
Note: If you use a non-standard port in your database
configuration, or have blocked access to port 1434 for SQL
database resolution, you must leave the Database Instance
parameter blank in your SIEM configuration.
Table Name Type a table or view that includes the event records as follows:
•
For ePO 3.x - Type Events .
•
For ePO 4.x - Type EPOEvents .
Select List Type
*
for all fields from the table or view.
You can use a comma-separated list to define specific fields from
tables or views, if required for your configuration. The list must
contain the field defined in the Compare Field parameter. The
comma-separated list can be up to 255 alphanumeric characters in
length. Also, the list can include the following special characters:
dollar sign ($), number sign (#), underscore (_), en dash (-), and
period(.).
Compare Field Type AutoID as the compare field. The compare field is used to
identify new events added between queries to the table.
Start Date and
Time Optional. Type the start date and time for database polling.
The Start Date and Time parameter must be formatted as
yyyy-MM-dd HH:mm with HH specified using a 24 hour clock. If the
start date or time is clear, polling begins immediately and repeats
at the specified polling interval.
Use Prepared
Statements Select this check box to use prepared statements.
Prepared statements allows the JDBC protocol source to setup the
SQL statement once, and then execute the SQL statement many
times with different parameters. For security and performance
reasons, we recommend that you use prepared statements.
Clearing this check box requires you to use an alternative method
of querying that does not use pre-compiled statements.
Polling Interval Type the polling interval, which is the amount of time between
queries to the event table. The default polling interval is 10
seconds.
You can define a longer polling interval by appending H for hours
or M for minutes to the numeric value. The maximum polling
interval is 1 week in any time format. Numeric values entered
without an H or M poll in seconds.
EPS Throttle Type the number of Event Per Second (EPS) that you do not want
this protocol to exceed. The default value is 20000 EPS.
Table 39-2 McAfee ePO JDBC Parameters (continued)
Parameter Description