Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 251 / 426

Configuring DSMs
44 N
AME
V
ALUE
P
AIR
The Name Value Pair (NVP) DSM allows you to integrate SIEM with devices that
may not natively send logs using syslog. The NVP DSM provides a log format that
allows you to send logs to SIEM. For example, for a device that does not export
logs natively with syslog, you can create a script to export the logs from a device
that SIEM does not support, format the logs in the NVP log format, and send the
logs to SIEM using syslog. The NVP DSM log source configured in SIEM then
receives the logs and is able to parse the data since the logs are received in the
NVP log format.
NOTE
The NVP DSM is not automatically detected by SIEM.
The NVP DSM accepts events using syslog. SIEM records all relevant events. The
log format for the NVP DSM must be a tab-separated single line list of
Name=Parameter. The NVP DSM does not require a valid syslog header.
NOTE
The NVP DSM assumes an ability to create custom scripts or thorough knowledge
of your device capabilities to send logs to SIEM using syslog in NVP format.
This section provides information on the following:
•
NVP Log Format
•
Examples
NVP Log Format
Table 44-1 includes a list of tags that the NVP DSM is able to parse:
Table 44-1 NVP Log Format Tags
Tag Description
DeviceType Type
NVP
as the DeviceType. This identifies the log
formats as a Name Value Pair log message.
This is a required parameter and
DeviceType=NVP
must
be the first pair in the list.