Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 303 / 426

Configuring DSMs
52 P
ALO
A
LTO
N
ETWORKS
The SIEM Palo Alto PA Series DSM accepts events using syslog. SIEM records
syslog threat events forwarded from Palo Alto PA Series firewalls that have been
classified into critical, high, medium, low and informational event categories.
Before you configure SIEM to integrate with a Palo Alto PA Series firewall, you
must:
Step 1
Log in to the Palo Alto Networks user interface.
Step 2
Click the Device tab.
The Device options menu is displayed.
Step 3
Select Log Destinations > Syslog .
The log settings configuration menu is displayed.
Step 4
Click New .
The New Syslog Setting menu is displayed.
Step 5
Configure the following options in the New Syslog Setting page:
•
Name - Type the name of the syslog server.
• Server - Type the IP address of your SIEM system.
• Port - Type the port number the SIEM system to receive syslog events. The
default port number is 514.
• Facility - From the drop-down list box, select the facility level from the available
options.
Step 6
Click OK .
You have now entered the syslog destination, but you must also define the severity
of events that are contained in the syslog messages.
Step 7
Select Log Setting > System .
The System Log Settings window is displayed, which allow you to define the
contents of the syslog messages for SIEM.
Step 8
Click Edit .
Step 9
Select the check box for each event severity level you want contained in the syslog
message.
Step 10
Type the name of the syslog destination you created in Step 5 .