Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 67 / 426

Configuring DSMs
Check Point Provider-1 51
mdsenv <customer name>
Step 5
Type the following command:
# nohup $FWDIR/bin/fw log -ftn | /usr/bin/logger -p
<facility>.<priority> 2>&1 &
Where:
<facility>
is a Syslog facility, for example, local3.
<priority>
is a Syslog priority, for example, info.
Step 6
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Check Point Provider-1 device:
Step 1
From the Log Source Type drop-down list box, select Check Point Firewall-1 .
Step 2
From the Protocol Configuration drop-down list box, select Syslog .
For more information on configuring log sources, see the Log Sources User Guide .
For more information about Check Point Provider-1, see the Check Point
Provider-1 documentation.
Integrating Check
Point Provider-1
Using OPSEC
This method ensures the SIEM Check Point Provider-1 DSM accepts Check Point
Provider-1 events using OPSEC.
To enable Check Point Provider-1 and SIEM integration, you must:
1
Configure Check Point Provider-1 SmartCenter. For more information, see
Reconfiguring Check Point Provider-1 SmartCenter .
2
Configure the log source in SIEM. For more information, see Configuring the
Check Point Log Source .
Reconfiguring Check Point Provider-1 SmartCenter
This section describes how to reconfigure the Check Point Provider-1
SmartCenter. In the Check Point Provider-1 Management Domain GUI (MDG),
create a host object representing the SIEM system. The leapipe is the connection
between the Check Point Provider-1 and SIEM.
To reconfigure the Check Point Provider-1 SmartCenter (MDG):
Step 1
To create a host object, open the Check Point SmartDashboard user interface and
select
Manage > Network Objects > New > Node > Host .
Step 2
Type the Name, IP Address, and optional Comment for your host.
Step 3
Click OK .
Step 4
Select Close .
Step 5
To create the OPSEC connection, select Manage > Servers and OPSEC
Applications New > OPSEC Application Properties .
Step 6
Type a name and optional comment.