Novell SENTINEL 6.1 SP2, Руководство пользователя, Страница: 261 / 528

Administration 261
no
vd
ocx
(e
n)
7 Ja
nua
ry 201
0
11.9 Event Configuration
NOTE: In order to use the Event Configuration, your
configuration.xml
file must be pointing to
a Communication Server that also has DAS_Binary and DAS_Query connected to it. This will
normally be the case, by default, as long as your Communication Server and DAS processes are
running.
11.9.1 Event Mapping
Event Mapping is a mechanism that allows you to add data to an event by using data already in the
event to reference and pull in data from an outside source. The outside data source is a map, which is
defined using
Map Data Configuration . The data already in the event that should be used as the
reference into the map and the data to be pulled from the map into the event are specified using the
Events tab.
Because virtually any data set can be made into a map, Event Mapping is useful for incorporating
into the event stream data from elsewhere in your organization. Some opportunities Event Mapping
provides are:

Regulatory Compliance monitoring

Policy compliance

Response prioritization

Enable security data to be analyzed related to business operations

Enhance accountability
When an Event Mapping is defined, it is applied system-wide to all events from all Collectors.
Additionally, Sentinel will automatically distribute map data to all processes that perform event
mappings as well as keep the map data in these processes up-to-date. For these reasons, Event
Mapping provides significant capabilities to support enterprise deployments.
Event Mapping comprises of four main parts:

Controller: Stores all map information
 Distributor: Automatically redistributes modified maps to those processes that registered for
the map

Monitor: A monitor to detect changes in map source data

Generator: Generates maps from source data
One application of Event Mapping is Sentinel's Asset Data functionality. For example, asset
information is collected and stored in the Sentinel Database asset schema and is represented by a
Physical Asset Entry. Soft assets, such as services and applications, are represented by an entry that
is linked to a Physical Asset. The primary automated update mechanism for asset data is through an
asset Collector reading data from a scanner such as Nmap. The asset Collector automates the
retrieval of asset information by reading asset data from the scanner and populating the asset schema
tables with this data. For Event Mapping, asset information is mapped from the destination IP and
source IP.
There are two types of data sources:

External: A Collector populates that value in the event tag.