Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 379 / 426

Configuring DSMs
70 T
IPPING
P
OINT
This section provides information on the following DSMs:
• TippingPoint Intrusion Prevention System
•
TippingPoint X505/X506 Device
TippingPoint
Intrusion
Prevention System
The SIEM TippingPoint Intrusion Prevention System (IPS) DSM accepts
TippingPoint events using syslog. SIEM records all relevant events from either a
Local Security Management (LMS) device or multiple devices with a Security
Management System (SMS).
Before you configure SIEM to integrate with TippingPoint, you must configure your
device based on type:
•
If you are using an SMS, see Configuring SMS Remote Syslog for Events .
•
If you are using an LSM, see Configuring the Notification Contacts for LSM .
Configuring SMS
Remote Syslog for
Events
The SIEM TippingPoint DSM accepts remote events using syslog, with all
information delivered to a SIEM server. Before configuring a TippingPoint SMS
device in SIEM, you must configure your TippingPoint device to send remote
syslog events to SIEM.
To configure your TippingPoint SMS:
Step 1
Log in to the TippingPoint system.
Step 2
On the Admin Navigation menu, select Server Properties .
Step 3
Select the Management tab.
Step 4
Click Add .
The Edit Syslog Notification window is displayed.
Step 5
Select the Enable check box.
Step 6
Configure the following values:
a
Syslog Server - Type the IP address of the SIEM system to receive syslog
event messages.
b
Port - Type 514 as the port address.