Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 400 / 426

Configuring DSMs
384 W
EBSENSE
V-S
ERIES
To configure SIEM to receive events from a Websense V-Series appliance:

From the Log Source Type drop-down list box, select Websense V Series .
For more information on configuring log sources, see the Log Sources User Guide .
For more information on configuring your Websense V-Series appliance, consult
your vendor documentation.
Websense V-Series
Content Gateway
The SIEM Websense V-Series Content Gateway DSM supports event for web
content on Websense V-Series appliances with the Content Gateway software.
The SIEM Websense V-Series Content Gateway DSM accepts events using
syslog to stream events or using the log file protocol to provide events to SIEM.
Before you can integrate SIEM, you must select one of the following configuration
methods:
•
To configure syslog for your Websense V-Series, see Configuring Syslog for the
Websense V-Series Content Gateway .
•
To configure the log file protocol for your Websense V-Series, see Configuring
Log File Protocol for the Websense V-Series Content Gateway .
Configuring Syslog
for the Websense
V-Series Content
Gateway
The Websense V-Series DSM supports Websense V-Series appliances running
the Websense Content Gateway on Linux software installations. Before
configuring SIEM, you must configure the Websense Content Gateway to provide
LEEF formatted syslog events.
To configure your Websense V-Series Content Gateway:
1 Configure the Management Console. For more information, see Configuring the
Management Console .
2 Enable event logging. For more information, see Enabling Event Logging .
Configuring the Management Console
To configure event logging in the Content Gateway Manager:
Step 1
Log into your Websense Content Gateway Manager.
Step 1
Click the Configure tab.
Step 2
Select Subsystems > Logging .
The General Logging Configuration window is displayed.
Step 3
Select Log Transactions and Errors .
Step 4
Select Log Directory to specify the directory path of the stored event log files.
The directory you define must already exist and the Websense user must have
read and write permissions for the specified directory. The default directory is
/opt/WGC/logs
Step 5
Click Apply .