Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 367 / 426

Configuring DSMs
67 S
YBASE
ASE
You can integrate a Sybase Adaptive Server Enterprise (ASE) device with SIEM. A
Sybase ASE accepts events using JDBC. Before you configure SIEM to integrate
with a Sybase ASE device, you must:
Step 1
Configure Sybase auditing.
For information about configuring Sybase auditing, see your Sybase
documentation.
Step 2
Log in to the Sybase database as an
sa
user:
isql -Usa -P<password>
Where
<password>
is the password necessary to access the database.
Step 3
Switch to the security database:
use sybsecurity
go
Step 4
Create a view for SIEM.
create view audit_view
as
select audit_event_name(event) as event_name, * from
<audit_table_1>
union
select audit_event_name(event) as event_name, * from
<audit_table_2>
go
Step 5
For each additional audit table in the audit configuration, make sure the union
select parameter is repeated for each additional audit table.
For example,
if you want to configure auditing with four audit tables (
sysaudits_01,
sysaudits_02,sysaudits_03, sysaudits_04), type the following:
create view audit_view as select audit_event_name(event) as
event_name, * from sysaudits_01
union select audit_event_name(event) as event_name, * from
sysaudits_02,