Enterasys Security Information and Event Manager (SIEM), Security Information and Event Manager Configuration Manual

Download

Page 1

Enterasys

Security Information and Event Manager (SIEM)

Configuring DSMs

Release 7.7.0

P/N 9034592-05

Page 2

Page 3

Notice

Enterasys Networks reserves the right to make changes in specifications and other information contained in this document and its web site without prior notice. The reader should in all cases consult Enterasys Networks to determine whether any such changes have been made.

The hardware, firmware, or software described in this document is subject to change without notice. IN NO EVENT SHALL ENTERASYS NETWORKS BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR

CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS DOCUMENT, WEB SITE, OR THE INFORMATION CONTAINED IN THEM, EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED OF, KNEW OF, OR SHOULD HAVE KNOWN OF, THE POSSIBILITY OF SUCH DAMAGES.

Enterasys Networks, Inc. 50 Minuteman Road Andover, MA 01810

therewith, are trademarks or registered trademarks of Enterasys Networks, Inc. in the United States and other countries. For a complete list of Enterasys trademarks, see http://www.enterasys.com/company/trademarks.aspx.

Celeron, Intel, and Pentium II are trademarks or registered trademarks of Intel Corporation. Linux is a trademark of Linus Torvalds. UNIX is a registered trademark of The Open Group. Enterasys SIEM contains a proprietary operating system based on Linux. All other product names mentioned in this document may be trademarks or registered trademarks of their respective

companies. Support Site URL: http://www.enterasys.com/support

Documentation URL: http://extranet.enterasys.com/downloads/

Page 4

Enterasys Networks, Inc. Software License Agreement

This document is an agreement (“Agreement”) between You, the end user, and Enterasys Networks, Inc. on behalf of itself and its Affiliates (“Enterasys”) that sets forth your right s and obligations with respect to the software contained in CD-ROM or other media. “Affiliates” means any person, partnership, corporation, limited liability company, or other form of enterprise that directly or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with the party specified. BY INSTALLING THE ENCLOSED PRODUCT, YOU ARE AGREEING TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT, WHICH INCLUDES THE LICENSE AND THE LIMITATION OF WARRANTY AND DISCLAIMER OF LIABILITY. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, RETURN THE UNOPENED PRODUCT TO ENTERASYS OR YOUR DEALER, IF ANY, WITHIN TEN (10) DAYS FOLLOWING THE DATE OF RECEIPT FOR A FULL REFUND.

IF YOU HAVE ANY QUESTIONS ABOUT THIS AGREEMENT, CONTACT ENTERASYS NETWORKS, INC. (978) 684-1000. Attn: Legal Department.

Enterasys will grant You a non-transferable, non-exclusive license to use the machine-readable form of software (the “Licensed Software”) and the accompanying documentation (the Licensed Software, the media embodying the Licensed Software, and the documentation are collectively referred to in this Agreement as the “Licensed Materials”) on one single computer if You agree to the following terms and conditions:

1. TERM. This Agreement is effective from the date on which You open the package containing the Licensed Materials. You may terminate the Agreement at any time by destroying the Licensed Materials, together with all copies, modifications and merged portions in any form. The Agreement and your license to use the Licensed Materials will also terminate if You fail to comply with any term or condition herein.

2. GRANT OF SOFTWARE LICENSE. The license granted to You by Enterasys when You open this sealed package authorizes You to use the Licensed Software on any one, single computer only, or any replacement for that computer, for internal use only. A separate license, under a separate Software License Agreement, is required for any other computer on which You or another individual or employee intend to use the Licensed Software. YOU MAY NOT USE, COPY, OR MODIFY THE LICENSED MATERIALS, IN WHOLE OR IN PART, EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT.

3. RESTRICTION AGAINST COPYING OR MODIFYING LICENSED MATERIALS. Except as expressly permitted in this Agreement, You may not copy or otherwise reproduce the Licensed Materials. In no event does the limited copying or reproduction permitted under this Agreement include the right to decompile, disassemble, electronically transfer, or reverse engineer the Licensed Software, or to translate the Licensed Software into another computer language.

The media embodying the Licensed Software may be copied by You, in whole or in part, into printed or machine readable form, in sufficient numbers only for backup or archival purposes, or to replace a worn or defective copy. However, You agree not to have more than two (2) copies of the Licensed Software in whole or in part, including the original media, in your possession for said purposes without Enterasys’ prior written consent, and in no event shall You operate more than one copy of the Licensed Software. You may not copy or reproduce the documentation. You agree to maintain appropriate records of the location of the original media and all copies of the Licensed Software, in whole or in part, made by You. You may modify the machine-readable form of the Licensed Software for (1) your own internal use or (2) to merge the Licensed Software into other program material to form a modular work for your own use, provided that such work remains modular, but on termination of this Agreement, You are required to completely remove the Licensed Software from any such modular work. Any portion of the Licensed Software included in any such modular work shall be used only on a single computer for internal purposes and shall remain subject to all the terms and conditions of this Agreement.

You agree to include any copyright or other proprietary notice set forth on the label of the media embodying the Licensed Software on any copy of the Licensed Software in any form, in whole or in part, or on any modification of the Licensed Software or any such modular work containing the Licensed Software or any part thereof.

4. TITLE AND PROPRIETARY RIGHTS.

(a) The Licensed Materials are copyrighted works and are the sole and exclusive property of Enterasys, any company or a

division thereof which Enterasys controls or is controlled by, or which may result from the merger or c onsolidation with Enterasys (its “Affiliates”), and/or their suppliers. This Agreement conveys a limited right to operate the Licensed Materials and shall not be construed to convey title to the Licensed Materials to You. There are no implied rights. You shall not sell, lease, transfer, sublicense, dispose of, or otherwise make available the Licensed Materials or any portion thereof, to any other party.

Page 5

(b) Y ou further acknowledge that in the event of a breach of this Agreement, Enterasys shall suffer severe and irreparable

damages for which monetary compensation alone will be inadequate. Y ou therefore agree that in the event of a breach of this Agreement, Enterasys shall be entitled to monetary damages and its reasonable attorney’s fees and costs in enforcing this Agreement, as well as injunctive relief to restrain such breach, in addition to any other remedies available to Enterasys.

5. PROTECTION AND SECURITY. In the performance of this Agreement or in contemplation thereof, You and your employees and agents may have access to private or confidential information owned or controlled by Enterasys relating to the Licensed Materials supplied hereunder including, but not limited to, product specifications and schematics, and such information may contain proprietary details and disclosures. All information and data so acquired by You or your employees or agents under this Agreement or in contemplation hereof shall be and shall remain Enterasys’ exclusive property, and You shall use your best efforts (which in any event shall not be less than the efforts You take to ensure the confidentiality of your own proprietary and other confidential information) to keep, and have your employees and agents keep, any and all such information and data confidential, and shall not copy, publish, or disclose it to others, without Enterasys’ prior written approval, and shall return such information and data to Enterasys at its request. Nothing herein shall limit your use or dissemination of information not actually derived from Enterasys or of information which has been or subsequently is made public by Enterasys, or a third party having authority to do so.

Y o u agree not to deliver or otherwise make available the Licensed Materials or any part thereof, including without limitation the object or source code (if provided) of the Licensed Software, to any party other than Enterasys or its employees, except for purposes specifically related to your use of the Lice nsed Software on a sing le computer as expressly provid ed in this Agreement, without the prior written consent of Enterasys. You agree to use your best efforts and take all reasonable steps to safeguard the Licensed Materials to ensure that no unauthorized personnel shall have access thereto and that no unauthorized copy, publication, disclosure, or distribution, in whole or in part, in any form shall be made, and You agree to notify Enterasys of any unauthorized use thereof. You acknowledge that the Licensed Materials contain valuable confidential information and trade secrets, and that unauthorized use, copying and/or disclosure thereof are harmful to Enterasys or its Affiliates and/or its/their software suppliers.

6. MAINTENANCE AND UPDATES. Updates and certain maintenance and support services, if any, shall be provided to You pursuant to the terms of a Enterasys Service and Maintenance Agreement, if Enterasys and You enter into such an agreement. Except as specifically set forth in such agreement, Enterasys shall not be under any obligation to provide Software Updates, modifications, or enhancements, or Software maintenance and support services to You.

7. DEFAULT AND TERMINATION. In the event that You shall fail to keep, observe, or perform any obligation under this Agreement, including a failure to pay any sums due to Enterasys, or in the event that You become insolvent or seek protection, voluntarily or involuntarily, under any bankruptcy law, Enterasys may, in addition to any other remedies it may have under law, terminate the License and any other agreements between Enterasys and You.

(a) Immediately after any termination of the Agreement or if You have for any reason discontinued use of Software, You

shall return to Enterasys the original and any copies of the Licensed Materials and remove the Licensed Software from any modular works made pursuant to Section 3, and certify in writing that through your best efforts and to the best of your knowledge the original and all copies of the terminated or discontinued Licensed Materials have been returned to Enterasys.

(b) Sections 4, 5, 7, 8, 9, 10, 11, and 12 shall survive termination of this Agreement for any reason.

8. EXPORT REQUIREMENTS. You understand that Enterasys and its Affiliates are subject to regulation by agencies of the U.S. Government, including the U.S. Department of Commerce, which prohibit export or diversion of certain technical products to certain countries, unless a license to export the product is obtained from the U.S. Government or an exception from obtaining such license may be relied upon by the exporting party.

If the Licensed Materials are exported from the United States pursuant to the License Exception CIV under the U.S. Export Administration Regulations, You agree that You are a civil end user of th e Licensed Materials and agree that You will use the Licensed Materials for civil end uses only and not for military purposes.

If the Licensed Materials are exported from the United States pursuant to the License Exception TSR under the U.S. Export Administration Regulations, in addition to the restriction on transfer set forth in Section 4 of this Agreement, You agree not to (i) reexport or release the Licensed Software, the source code for the Licensed Software or technology to a national of a country in Country Groups D:1 or E:2 (Albania, Armenia, Azerbaijan, Belarus, Cambodia, Cuba, Georgia, Iraq, Kazakhstan, Kyrgyzstan, Laos, Libya, Macau, Moldova, Mongolia, North Korea, the People’s Republic of China, Russia, Tajikistan,

Page 6

Turkmenistan, Ukraine, Uzbekistan, V ietnam, or such other countries as may be designated by the United States Government), (ii) export to Country Groups D:1 or E:2 (as defined herein) the direct product of the Licensed Software or the technology, if such foreign produced direct product is subject to national security controls as identified on the U.S. Commerce Control List, or (iii) if the direct product of the technology is a complete plant o r any major component of a plant, export to Country Groups D:1 or E:2 the direct product of the plant or a major component thereof, if such foreign produced dire ct product is subject to national security controls as identified on the U.S. Commerce Control List or is subject to State Department controls under the U.S. Munitions List.

9. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The Licensed Materials (i) were developed solely at private expense; (ii) contains “restricted computer software” submitted with restricted rights in accordance with section 52.227-19 (a) through (d) of the Commercial Computer Software-Restricted Rights Clause and its successors, and (iii) in all respects is proprietary data belonging to Enterasys and/or its suppliers. For Department of Defense units, the Licensed Materials are considered commercial computer software in accordance with DFARS section 227.7202-3 and its successors, and use, duplication, or disclosure by the U.S. Government is subject to restrictions set forth herein.

10. LIMITED WARRANTY AND LIMITATION OF LIABILITY. The only warranty Enterasys makes to You in co nnection with this license of the Licensed Materials is that if the media on which the Licensed Software is recorded is defective, it will be replaced without charge, if Enterasys in good faith determines that the media and proof of payment of the license fee are returned to Enterasys or the dealer from whom it was obtained within ninety (90) days of the date of payment of the license fee.

NEITHER ENTERASYS NOR ITS AFFILIA TES MAKE ANY OTHER W ARRANTY OR REPRESENTATION, EXPRESS OR IMPLIED, WITH RESPECT TO THE LICENSED MATERIALS, WHICH ARE LICENSED "AS IS". THE LIMITED WARRANTY AND REMEDY PROVIDED ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, WHICH ARE EXPRESSLY DISCLAIMED, AND STATEMENTS OR REPRESENTATIONS MADE BY ANY OTHER PERSON OR FIRM ARE VOID. ONLY TO THE EXTENT SUCH EXCLUSION OF ANY IMPLIED WARRANTY IS NOT PERMITTED BY LAW , THE DURATION OF SUCH IMPLIED WARRANTY IS LIMITED TO THE DURATION OF THE LIMITED WARRANTY SET FORTH ABOVE. YOU ASSUME ALL RISK AS TO THE QUALITY, FUNCTION AND PERFORMANCE OF THE LICENSED MATERIALS. IN NO EVENT WILL ENTERASYS OR ANY OTHER PARTY WHO HAS BEEN INVOLVED IN THE CREATION, PRODUCTION OR DELIVERY OF THE LICENSED MATERIALS BE LIABLE FOR SPECIAL, DIRECT, INDIRECT, RELIANCE, INCIDENTAL OR CONSEQUENTIAL DAMAGES, INCLUDING LOSS OF DATA OR PROFITS OR FOR INABILITY TO USE THE LICENSED MA TERIALS, TO ANY PARTY EVEN IF ENTERASYS OR SUCH OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT SHALL ENTERASYS OR SUCH OTHER PA RTY'S LIABILITY FOR ANY DAM AGES OR LOSS TO YOU OR ANY OTHER PARTY EXCEED THE LICENSE FEE YOU PAID FOR THE LICENSED MATERIALS.

Some states do not allow limitations on how long an implied warranty lasts and some states do not allow the exclusion or limitation of incidental or consequential damages, so the above limitation and exclusion may not apply to You. This limited warranty gives Y ou specific legal rights, and You may also have other rights which vary from state to state.

11. JURISDICTION. The rights and obligations of the parties to this Agreement shall be governed and construed in accordance with the laws and in the State and Federal courts of the Commonwealth of Massachusetts, without regard to its rules with respec to choice of law. You waive any objections to the personal jurisdiction and venue of such courts. None of the 1980 United Nations Convention on the Limitation Period in the International Sale of Goods, and the Uniform Computer Information Transactions Act shall apply to this Agreement.

12. GENERAL.

(a) This Agreement is the entire agreement between Enterasys and You regarding the Licensed Materials, and all prior

agreements, representations, statements, and undertakings, oral or written, are hereby expressly superseded and

canceled. (b) This Agreement may not be changed or amended except in writing signed by both parties hereto. (c) You represent that You have full right and/or authorization to enter into this Agreement. (d) This Agreement shall not be assignable by You without the express written consent of Enterasys, The rights of

Enterasys and Y our obligations under this Agreement shall inure to the benefit of Enterasys’ assignees, licensors, and

licensees. (e) Section headings are for convenience only and shall not be considered in the interpretation of this Agreement. (f) The provisions of the Agreement are severable and if any one or more of the provisions hereof are judicially determined

to be illegal or otherwise unenforceable, in whole or in part, the remaining provisions of this Agreement shall

nevertheless be binding on and enforceable by and between the parties hereto.

Page 7

(g) Enterasys’ waiver of any right shall not constitute waiver of that right in future. This Agreement constitutes the entire

understanding between the parties with respect to the subject matter hereof, and all prior agreements, representations,

statements and undertakings, oral or written, are hereby expressly superseded and canceled. No purchase order shall

supersede this Agreement. (h) Should You have any questions regarding this Agreement, You may contact Enterasys at the address set forth below.

Any notice or other communication to be sent to Enterasys must be mailed by certified mail to the following address:

ENTERASYS NETWORKS, INC., 50 Minuteman Road, Andover, MA 01810 Attn: Manager - Legal Department.

Page 8

Page 9

CONTENTS

ABOUT THIS GUIDE

Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1

Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1

Contacting Customer Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

1 OVERVIEW

2 INSTALLING DSMS

3 3COM 8800 SERIES SWITCH

4 AMBIRON TRUSTWAVE IPANGEL

5 APACHE HTTP SERVER

Configuring Apache Using Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Configuring Apache Using Syslog-ng . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12

6 APPLE MAC OS X

7 ARUBA MOBILITY CONTROLLERS

8 ARRAY NETWORKS SSL VPN

9 BIT9 PARITY

10 BLUE COAT SG

Creating a Custom Format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

Custom Format Addition Key-Value Pairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Page 10

11 BRIDGEWATER

12 CA TECHNOLOGIES

CA ACF2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31

CA Top Secret . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36

13 CHECK POINT

Check Point FireWall-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

Check Point Provider-1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50

14 CISCO

Cisco ACE Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53

Cisco Aironet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54

Cisco ACS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55

Cisco ASA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57

Cisco CatOS for Catalyst Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60

Cisco CSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61

Cisco FWSM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62

Cisco IDS/IPS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62

Cisco IronPort. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63

Cisco NAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64

Cisco IOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65

Cisco Pix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .66

Cisco VPN 3000 Concentrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .67

Cisco Wireless Services Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68

15 CITRIX NETSCALER

16 CRYPTOCARD CRYPTO-SHIELD

17 CYBER-ARK VAULT

18 CYBERGUARD FIREWALL/VPN APPLIANCE

19 EMC VMWARE

Configuring Syslog for VMWare. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79

Configuring the VMWare Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80

20 ENTERASYS

Enterasys Dragon. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83

Enterasys HiGuard Wireless IPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90

Enterasys HiPath Wireless Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91

Enterasys Stackable and Standalone Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92

Page 11

Enterasys XSR Security Router. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93

Enterasys Matrix Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94

Enterasys NetSight Automatic Security Manager . . . . . . . . . . . . . . . . . . . . . . . . . . .95

Enterasys Matrix K/N/S Series Switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96

Enterasys NAC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

21 EXTREME NETWORKS EXTREMEWARE

22 F5 NETWORKS

F5 Networks BIG-IP LTM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101

F5 Networks BIG-IP ASM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103

F5 Networks FirePass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104

23 FAIR WARNING

24 FIREEYE

25 FORESCOUT COUNTERACT

26 FORTINET FORTIGATE

27 FOUNDRY FASTIRON

28 GENERIC FIREWALL

29 GENERIC AUTHORIZATION SERVER

30 HP

HP ProCurve . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .125

HP Tandem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .125

Hewlett Packard UNIX (HP-UX). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .126

31 IBM

IBM AIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129

IBM AS/400 iSeries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131

IBM Lotus Domino . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134

IBM Proventia Management SiteProtector. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137

IBM ISS Proventia . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .140

IBM RACF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .141

IBM DB2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145

IBM WebSphere Application Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148

IBM Informix Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150

Page 12

IBM IMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .151

32 ISC BIND

33 IMPERVA SECURESPHERE

34 INFOBLOX NIOS

35 ITRON SMART METER

36 JUNIPER NETWORKS

Juniper Networks AVT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .169

Juniper DX Application Acceleration Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171

Juniper EX-Series Ethernet Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .171

Juniper NetScreen IDP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .173

Juniper Networks Secure Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174

Juniper Infranet Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177

Juniper Networks Firewall and VPN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177

Juniper Networks Network and Security Manager. . . . . . . . . . . . . . . . . . . . . . . . . .178

Juniper JunOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .179

Juniper Steel-Belted Radius. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .183

Juniper Networks vGW Virtual Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .185

37 LIEBERMAN RANDOM PASSWORD MANAGER

38 LINUX

Linux DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189

Linux IPtables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189

Linux OS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191

39 MCAFEE

McAfee Intrushield . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193

McAfee ePolicy Orchestrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194

McAfee Application / Change Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200

McAfee Web Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .203

40 METAINFO METAIP

41 MICROSOFT

Microsoft Exchange Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209

Microsoft IAS Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213

Microsoft DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213

Page 13

Microsoft IIS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214

Microsoft ISA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .220

Microsoft SQL Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .221

Microsoft Windows Security Event Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .221

Microsoft Operations Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .223

Microsoft System Center Operations Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . .226

42 MOTOROLA SYMBOL AP

43 NETAPP DATA ONTAP

44 NAME VALUE PAIR

NVP Log Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .235

Examples. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .237

45 NIKSUN

46 NOKIA FIREWALL

Integrating Nokia Firewall Using Syslog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .241

Integrating Nokia Firewall Using OPSEC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .242

47 NORTEL NETWORKS

Nortel Multiprotocol Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .245

Nortel Application Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .248

Nortel Contivity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .249

Nortel Ethernet Routing Switch 2500/4500/5500. . . . . . . . . . . . . . . . . . . . . . . . . . .249

Nortel Ethernet Routing Switch 8300/8600 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .250

Nortel Secure Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

Nortel Secure Network Access Switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .253

Nortel Switched Firewall 5100 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .254

Nortel Switched Firewall 6000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .256

Nortel Threat Protection System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .258

Nortel VPN Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .259

48 NOVELL EDIRECTORY

49 OPENBSD

50 OPEN SOURCE SNORT

51 ORACLE

Oracle Audit Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .271

Page 14

Oracle DB Listener. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .274

Oracle Audit Vault. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .278

Oracle OS Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .280

Oracle BEA WebLogic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .282

52 PALO ALTO NETWORKS

53 PROFTPD

54 RADWARE DEFENSEPRO

55 REDBACK ASE

56 RSA AUTHENTICATION MANAGER

57 SAMHAIN LABS

Using Syslog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .299

Using JDBC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .300

58 SENTRIGO HEDGEHOG

59 SECURE COMPUTING SIDEWINDER

60 SONICWALL

61 SOPHOS

Sophos Enterprise Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .309

Sophos PureMessage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .315

Sophos Astaro Security Gateway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322

Sophos Web Security Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .323

62 SOURCEFIRE

Sourcefire Intrusion Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .325

Sourcefire Defense Center (DC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .326

Page 15

63 SQUID WEB PROXY

64 STARENT NETWORKS

65 STONESOFT MANAGEMENT CENTER

66 SUN SOLARIS

Sun Solaris. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .341

Sun Solaris DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .342

Sun Solaris Sendmail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .342

Sun Solaris Basic Security Mode (BSM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .343

67 SYBASE ASE

68 SYMANTEC

Symantec Endpoint Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .353

Symantec SGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354

Symantec System Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .354

Symantec Data Loss Prevention (DLP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .358

69 SYMARK

70 TIPPINGPOINT

TippingPoint Intrusion Prevention System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .363

TippingPoint X505/X506 Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .365

71 TOP LAYER IPS

72 TREND MICRO

Trend Micro InterScan VirusWall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .369

Trend Micro Control Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .369

Trend Micro Office Scan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .370

Page 16

73 TRIPWIRE

74 TROPOS CONTROL

75 UNIVERSAL DSM

76 VERICEPT CONTENT 360 DSM

77 WEBSENSE V-SERIES

Websense V-Series Data Security Suite . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .383

Websense V-Series Content Gateway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .384

78 SUPPORTED DSMS

INDEX

Page 17

ABOUT THIS GUIDE

NOTE

CAUTION

WARNING

The Enterasys SIEM Administration Guide provides you with information for managing SIEM functionality requiring administrative access.

Note that Enterasys SIEM was previously referred to as Dragon Security Command Console under Dragon Network Defense.

Audience This guide is intended for the system administrator responsible for setting up SIEM

in your network. This guide assumes that you have SIEM administrative access and a knowledge of your corporate network and networking technologies.

Conventions The following conventions are used throughout this guide:

Indicates that the procedure contains a single instruction.

Related Documentation

Indicates that the information provided is supplemental to the associated feature or instruction.

Indicates that the information is critical. A caution alerts you to potential loss of data or potential damage to an application, system, device, or network.

Indicates that the information is critical. A warning alerts you to potential dangers, threats, or potential personal injury. Read any and all warnings carefully before proceeding.

For more information, refer to the Enterasys Extranet to obtain the latest Enterasys SIEM documentation including:

• Installation Guide

• Hardware Installation Guide

Configuring DSMs

Page 18

2 ABOUT THIS GUIDE

• Administration Guide

• Users Guide

• Configuring DSMs

• Upgrading to SIEM 7.7.0

• Tuning Guide

• Adaptive Log Exporter

• SIEM 7.7.0 Release Notes

Contacting Customer Support

For additional support related to the product or this document, contact Enterasys Networks using one of the following methods:

World Wide Web http://www.enterasys.com/support Phone 1-800-872-8440 (toll-free in U.S. and Canada)

or 1-978-684-1000 For the Enterasys Networks Support toll-free number in your

country:

http://www.enterasys.com/support

Email [email protected]

To expedite your message, please type [dragon] in the subject line.

Configuring DSMs

Page 19

NOTE

OVERVIEW

You can configure SIEM to log and correlate events received from external sources such as security equipment (for example, firewalls), and network equipment (for example, switches and routers). Device Support Modules (DSMs) allows you to integrate SIEM with these external devices.

In SIEM 7.6.3 and above, sensor devices are now referred to as log sources. Therefore, all references to log sources also refer to sensor devices.

You can configure the Event Collector to collect security events from various types of security devices in your network. The Event Collector gathers events from local and remote devices. The Event Collector then normalizes and bundles the events and sends the events to the Event Processor.

All events are correlated and security and policy offenses are created based on correlation rules. These offenses are displayed on the Offenses tab. For more information, see the SIEM Users Guide.

Before you configure SIEM to collect security information from devices, you must set-up your deployment, including off-site sources or targets, using the deployment editor. For more information on the deployment editor, see the SIEM Administration Guide.

Information found in this documentation about configuring Device Support Modules (DSMs) is based on the latest RPM files located on the Enterasys Extranet, located at http://extranet.enterasys.com/downloads.

To configure SIEM to re ceive events from devices, you must:

1 Configure the device to send events to SIEM. 2 Configure SIEM to receive events from specific devices. For more information, see

the Log Sources User Guide.

Configuring DSMs

Page 20

Page 21

INSTALLING DSMS

The Enterasys Extranet contains RPM files that allow you to install new or update existing DSMs. Updated DSMs contain improved event parsing for network security products and enhancements for event categorization in the SIEM Identification Map (QIDmap).

To install a DSM, perform the following steps:

Step 1 Download the file to your system hosting SIEM. Step 2 Using SSH log in to SIEM, as the root user.

Username: Password: <password>

Step 3 Navigate to the directory that includes the downloaded file. Step 4 Type the following command:

rpm -Uvh <filename>

Where <filename> is the name of the downloaded file. For example:

rpm -Uvh DSM-CheckPointFirewall-7.0-209433.noarch.rpm

Step 5 Log in to SIEM.

https:// Where <IP Address> is the IP address of the SIEM system.

Step 6 On the Admin tab, click Deploy Changes.

root

Configuring DSMs

Page 22

Page 23

3COM 8800 SERIES SWITCH

A SIEM 3Com 8800 Series Switch DSM accepts events using syslog. SIEM records all relevant status and network condition events. Before configuring a 3Com 8800 Series Switch device in SIEM, you must configure your device to send syslog events to SIEM.

To configure the de vice to send syslog events to SIEM:

Step 1 Log in to the 3Com 8800 Series Switch user interface. Step 2 Enable the information center.

info-center enable

Step 3 Configure the host with the IP address of your SIEM system as the loghost, the

severity level threshold value as informational, and the output language to English.

info-center loghost <ip_address> facility <severity> language english

Where:

<ip_address> is the IP address of your SIEM system. <severity> is the facility severity.

Step 4 Configure the ARP and IP information modules to log.

info-center source arp channel loghost log level informational info-center source ip channel loghost log level informational

Step 5 You now are ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a 3Com 8800 Series Switch:

From the Log Source T ype drop-down list box, select the 3Com 8800 Series

Switch option.

For more information on configuring log sources, see the Log Sources User Guide.

Configuring DSMs

Page 24

Page 25

AMBIRON TRUSTWAVE ipANGEL

A SIEM Ambiron TrustWave ipAngel DSM accepts events using syslog. SIEM records all Snort-based events from the ipAngel console.

Before you configure SIEM to integrate with ipAngel, you must forward your cache and access logs to your SIEM system. For information on forwarding device logs to SIEM, see your vendor documentation.

You are now ready to configure the log source in SIEM. To configure SIEM to re ceive events from a ipAngle device:

From the Log Source Type drop-down list box, select the Ambiron

TrustWave ipAngel Intrusion Prevention System (IPS) option. For more

information on configuring log sources, see the Log Sources User Guide.

Configuring DSMs

Page 26

Page 27

CAUTION

APACHE HTTP SERVER

A SIEM Apache HTTP Server DSM accepts Apache events using syslog or syslog-ng. SIEM records all relevant HTTP status events. The procedure in this section applies to Apache DS Ms op erating on UNIX/Linux plat forms only.

Select one of the following configuration methods:

• Configuring Apache Using Syslog

• Configuring Apache Using Syslog-ng

Do not run both syslog and syslog-ng at the same time.

Configuring Apache Using Syslog

To configure Apache using the syslog protocol:

Step 1 Log in to the server hosting Apache, as the root user. Step 2 Edit the Apache configuration file httpd.conf. Step 3 Add the following information in the Apache configuration file to specify the custom

log format:

LogFormat "%h %A %l %u %t \"%r\" %>s %p %b" <log format name>

Where <log format name> is a variable name you provide to define the log format.

Step 4 Add the following information in the Apache configuration file to specify a custom

path for the syslog events:

CustomLog “|/usr/bin/logger -t httpd -p <facility>.<priority>” <log format name>

Where:

<facility> is a syslog facility, for example, local0. <priority> is a syslog priority, for example, info or notice. <log format name> is a variable name you provide to define the custom log

format. The log format name must match the log format defined in Step 4.

Configuring DSMs

Page 28

12 APACHE HTTP SERVER

Step 5 Type the following command to disabled hostname lookup:

Step 6 Save the Apache configuration file. Step 7 Edit the syslog configuration file.

Step 8 Add the following information to your syslog configuration file:

For example,

CustomLog “|/usr/bin/logger -t httpd -p local1.info” MyApacheLogs

HostnameLookups off

/etc/syslog.conf

Where:

<facility> is the syslog facility, for example, local0. This value must match the value you typed in

Step 4.

Configuring Apache Using Syslog-ng

<priority> match the value you typed in

<TAB>

is the syslog priority, for example, info or notice. This value must

Step 4.

indicates you must press the Tab key.

<host> is the IP address of the SIEM Console or Event Collector.

Step 9 Save the syslog configuration file.

Step 10 Type the following command to restart the syslog service:

/etc/init.d/syslog restart

Step 11 Restart Apache to complete the syslog configuration. Step 12 You are now ready to configure the log source in SIEM.

SIEM automatically detects syslog events from an Apache HTTP Server . However, if you want to manually configure SIEM to receive events from Apache:

From the Log Source Type drop-down list box, select Apache HTTP Server.

For more information on Apache, see http://www.apache.org/.

To configure Apache using the syslog-ng protocol:

Step 1 Log in to the server hosting Apache, as the root user. Step 2 Edit the Apache configuration file.

/etc/httpd/conf/httpd.conf

Step 3 Add the following information to the Apache configuration file to specify the

LogLevel:

Configuring DSMs

Page 29

Configuring Apache Using Syslog-ng 13

LogLevel info

The LogLevel may already be configured to the info level depending on your Apache installation.

Step 4 Add the following to the Apache configuration file to specify the custom log format:

LogFormat "%h %A %l %u %t \"%r\" %>s %p %b" <log format name>

Where <log format name> is a variable name you provide to define the custom log format.

Step 5 Add the following information to the Apache configuration file to specify a custom

path for the syslog events:

CustomLog "|/usr/bin/logger -t 'httpd' -u /var/log/httpd/apache_log.socket" <log format name>

The log format name must match the log format defined in Step 4.

Step 6 Save the Apache configuration file. Step 7 Edit the syslog-ng configuration file.

/etc/syslog-ng/syslog-ng.conf

Step 8 Add the following information to specify the destination in the syslog-ng

configuration file:

source s_apache {

unix-stream("/var/log/httpd/apache_log.socket" max-connections(512)

keep-alive(yes)); }; destination auth_destination { <udp|tcp>("<IP address>"

port(514)); }; log{

source(s_apache);

destination(auth_destination); };

Where:

<IP address> is the IP address of the SIEM Console or Eve nt Collector. <udp|tcp> is the protocol you select to forward the syslog event.

Step 9 Save the syslog-ng configuratio n file.

Step 10 Type the following command to restart syslog-ng:

service syslog-ng restart

Step 11 You are now ready to configure the log source in SIEM.

Configuring DSMs

Page 30

14 APACHE HTTP SERVER

SIEM automatically detects syslog-ng events from an Apache HTTP Server. However, if you want to manually configure SIEM to receive events from Apache:

From the Log Source Type drop-down list box, select Apache HTTP Server.

For more information on Apache, see http://www.apache.org/.

Configuring DSMs

Page 31

APPLE MAC OS X

A SIEM Apple Mac OS X DSM accepts events using syslog. SIEM records all relevant firewall, web server access, web server error, privilege escalation, and informational events.

Before you configure SIEM to integrate with Mac OS X, you must:

Step 1 Log in to your Mac OS X device, as a root user. Step 2 Open the /etc/syslog.conf file. Step 3 Add the following line to the top of the file. Make sure all other lines remain intact:

*.*@<IP address>

Where <IP address> is the IP address of the SIEM system.

Step 4 Save and exit the file. Step 5 Send a hang-up signal to the syslog daemon to make sure all changes are

enforced:

sudo killall - HUP syslogd

Step 6 You are now ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a Mac OS X server:

From the Log Source Type drop-down list box, select the Mac OS X option.

For more information on configuring log sources, see the Log Sources User Guide. For more information on Mac OS X, see your Mac OS X vendor documentation.

Configuring DSMs

Page 32

Page 33

ARUBA MOBILITY CONTROLLERS

The SIEM Aruba Mobility Controllers DSM accepts events using syslog. SIEM records all relevant events. Before configuring an Aruba Mobility Controller device in SIEM, you must configure your device to send syslog events to SIEM.

To configure the Aruba Wireless Networks (Mobility Controller) device to forward syslog events to SIEM:

Step 1 Log in to the Aruba Mobility Controller user interface. Step 2 From the top menu, se lect Configuration. Step 3 From the Switch menu, select Management. Step 4 Click the Logging tab. Step 5 From the Logging Servers menu, select Add. Step 6 Type the IP address of the SIEM server that you want to collect logs. Step 7 Click Add. Step 8 Optio nal. Change the logging level for a module:

a Select the check box next to the name of the logging module. b Choose the logging level you want to change from the drop-down list box that is

displayed at the bottom of the window.

Step 9 Click Done. Step 10 Click Apply. Step 11 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from an Aruba Mobility Controller device:

From the Log Source Type drop-down list box, select the Aruba Mobility

Controller option.

For more information on configuring log sources, see the Log Sources User Guide. For more information about your Aruba Mobility Controller device, see your vendor

documentation.

Configuring DSMs

Page 34

Page 35

ARRAY NETWORKS SSL VPN

The SIEM Array Networks SSL VPN DSM collects events from an ArrayVPN appliance using syslog. For details of configuring ArrayVPN appliances for remote syslog, please consult Array Networks documentation.

Once you configure syslog to forward events to SIEM, you are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Array Networks SSL VPN device:

From the Log Source Type drop-down list box, select Array Networks SSL

VPN Access Gateways.

For more information on configuring log sources, see the Log Sources User Guide. For more information about configuring your Array Networks SSL VPN, see your

vendor documentation.

Configuring DSMs

Page 36

Page 37

BIT9 PARITY

The SIEM Bit9 Parity DSM accepts events using the Log Enhanced Event Format (LEEF), enabling SIEM to record all relevant events. Before configuring a Bit9 Parity DSM in SIEM, you must configure your Bit9 Parity device to send events to SIEM.

To configure your Bit9 Parity device, you must:

Step 1 Log in to the Bit9 Parity console with Administrator or PowerUser privileges.

Step 2 From the navigation menu on the left side of the console, select Administration >

System Configuration.

The System Configuration window is displayed.

Step 3 Click Server Status.

The Server Status window is displayed.

Step 4 Click Edit.

Step 5 In the Syslog address field, type the IP address of your SIEM system.

Step 6 From the Syslog format drop-down list box, select LEEF (Q1Labs).

Step 7 Select the Syslog enabled check box.

Step 8 Click Update.

Step 9 You are now ready to configure the log source in SIEM.

SIEM automatically detects a Bit9 Parity device. However, if you want to manually configure SIEM to receive events from Bit9:

From the Log Source Type drop-down list box, select Bit9 Parity.

For more information on configuring log sources, see the Log Sources User Guide. For more information about your Bit9 Parity device, see your vendor

documentation.

Configuring DSMs

Page 38

Page 39

BLUE COAT SG

A Blue Coat SG DSM allows you to integrate SIEM with a Blue Coat SG appliance. SIEM records all relevant and available information from the event. The Blue Coat SG DSM supports the following formats:

• Custom Format

• SQUID

• NCSA

• main

• IM

• Streaming

• smartreporter

• bcereportermain_v1

• bcreporterssl_v1

Creating a Custom Format

Step 1 Using a web browser, log in to the Blue Coat Management Console.

Step 2 Select Configuration > Access Logging > Formats.

Step 3 Select New.

• p2p

• SSL

• bcreportercifs_v1

• CIFS

• MAPI

For more information about your Blue Coat SG Appliance, see your vendor documentation.

A SIEM Blue Coat SG DSM accepts custom formatted events from a Blue Coat SG Appliance.

To create a custom format for your Blue Coat device:

The Edit Format window is displayed.

Configuring DSMs

Page 40

24 BLUE COAT SG

NOTE

Step 4 Step 5 Select Custom format string. Step 6 Type the following custom format for SIEM:

Type a format name for the custom format.

Step 7 Select Log Last Header from the drop-down list box. Step 8 Click OK. Step 9 Click Apply.

The custom format for SIEM supports additional key-value pairs using the Blue Coat ELFF format. For more information, see Custom Format Addition Key-Value

Pairs.

Creating a Log

Facility

Step 1 Select Configuration > Access Logging > Logs.

Step 2 Click New.

Step 3 Configur e the following parameters:

Step 4 Click OK. Step 5 Click Apply.

You are ready to enable access logging on your Blue Coat device. For more information, see Creating a Log Facility

To use the custom log format created for SIEM, you must associate the custom log format for SIEM to a facility. To create a log facility:

The Logs Configuration window is displayed.

The Create Log window is displayed.

• Log Name - Type a name for the log facility.

• Log Format - Select the custom fo rmat you created in Step 4.

• Description - Type a description for the log facility.

You are ready to enable logging on the Blue Coat device. For more information, see Enabling Access Logging.

Configuring DSMs

Page 41

Creating a Custom Format 25

Enabling Access

Logging

Step 1 Select Configuration > Access Logging > General.

Step 2 Select the Enable Access Logging check box.

Step 3 Click Apply .

Configuring Blue

Coat Upload Client

Step 1 Select Configuration > Access Logging > Logs > Upload Client.

To enable access logging on your Blue Coat SG device:

The Default Logging tab is displayed.

If the Enable Access Logging check box is not selected, logging is disabled globally for all of the formats listed.

You are ready to configure the Blue Coat upload client. For more information, see

Configuring Blue Coat Upload Client.

The Blue Coat upload client can forward events to SIEM using FTP or syslog.

• If you are using FTP and the Log File protocol with SIEM, see Configuring FTP

and the Log File Protocol.

• If you are using Syslog with SIEM, see Configuring Syslog in Blue Coat.

Configuring FTP and the Log File Protocol

To configure the Blue Coat upload client for FTP:

Step 2 From the Log drop-down list box, select the log containing your custom format. Step 3 From the Client type drop-down list box, select FTP Client. Step 4 Click Settings. Step 5 From the Settings For drop-down list box, select Primary FTP Server. Step 6 Configure the following values:

a Host - Type the IP address of the FTP server receiving the Blue Coat events. b Port - Type the FTP port number. c Path - Type a directory path for the log files.

d Username - Type the username required to access the FTP server. Step 7 Click OK. Step 8 Select the Upload Schedule tab. Step 9 From the Upload the access log option, select periodically.

Step 10 Configure the Wait time between connect attempts. Step 11 Select if you want to upload the log file to the FTP daily or on an interval. Step 12 Click Apply. Step 13 You are now ready to configure the log source and protocol in SIEM:

Configuring DSMs

Page 42

26 BLUE COAT SG

CAUTION

To configure SIEM to receive events from a Blue Coat SG device:

Step 1 From the Log Source Type drop-down list box, select the Bluecoat SG

Appliance option.

Step 2 From the Protocol Configuration drop-down list box, select the Log File option.

When configuring your BlueCoat device to use the Log File protocol configuration, make sure the hostname or IP address configured in the BlueCoat device is the same as configured in the Remote Host parameter in the Log File protocol. For more information, see the Log Sources User Guide.

Configuring Syslog in Blue Coat

If your Blue Coat SG appliance is reporting events using syslog (rather than a file

transfer protocol) and the destination syslog server becomes unavailable, it is

possible that other syslog destinations may stop receiving data until all syslog

destinations are again av ailable. This creates the potential for some syslog data to

not be sent at all. If you are sendin g to multiple syslog destinations, a disruption in

availability in one syslog destination may interrupt the stream of events to other

syslog destinations from your Blue Coat SG appliance.

To configure the Blue Coa t uplo ad client for syslog:

Step 1 Select Configuration > Access Logging > Logs > Upload Client. Step 2 From the Log drop-down list box, select the log containing your custom format. Step 3 From the Client type drop-down list bow, select Custom Client. Step 4 Click Settings. Step 5 From the Settings For drop-down list box, select Primary Custom Server. Step 6 Configur e the following values:

a Host - Type the IP address of your SIEM system.

b Port - Type 514 as the syslog port for SIEM. Step 7 Click OK. Step 8 Select the Upload Schedule tab. Step 9 From the Upload the access log, select continuously.

Step 10 Click Apply. Step 11 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Blue Coat SG device:

From the Log Source Type drop-down list box, select the Bluecoat SG

Appliance option.

For more information on configuring log sources, see the Log Sources User Guide.

Configuring DSMs

Page 43

Custom Format Addition Key-Value Pairs 27

For more information about configuring syslog, see your Bluecoat SG vendor documentation.

Custom Format Addition Key-Value Pairs

The custom format allows you to forward specific Blue Coat data or events to SIEM using the Extended Log File Format (ELFF). The custom format is a series of pipe delimited fields starting with

Parameter)

. Custom format fields for SIEM must be separated by the pipe

Bluecoat| and containing $(Blue Coat ELFF

character. For example:

Table 10-1 SIEM Custom Format Examples

Blue Coat ELFF Parameter SIEM Custom Format Example

sc-bytes $(sc-bytes) rs(Content-type) $(rs(Content-Type))

For more information on the available Blue Coat ELFF parameters, see your Blue Coat appliance documentation.

Configuring DSMs

Page 44

Page 45

NOTE

BRIDGEWATER

The SIEM Bridgewater System DSM accepts events using syslog. SIEM records all relevant events. Before configuring a Bridgewater Systems device in SIEM, you must configure your device to send syslog events to SIEM.

To configure the de vice to send syslog events to SIEM:

Step 1 Log in to your Bridgewater Systems device command line interface (CLI). Step 2 To log operational messages to the RADIUS and Diameter servers, open the

following file:

/etc/syslog.conf

Step 3 To log all operational messages, uncomment the following line:

local1.info /WideSpan/logs/oplog

Step 4 To log error messages only, change the local1.info /WideSpan/logs/oplog

line to the following:

local1.err /WideSpan/logs/oplog

RADIUS and Diameter system messages are stored in the /var/adm/messages file.

Step 5 Add the following line:

local1.*@<IP address>

Where <IP address> is the IP address of the Event Collector.

Step 6 The RADIUS and Diameter server system messages are stored in the

/var/adm/messages file. Add the following line for the system messages:

Where:

<facility> is the facility used for logging to the /var/adm/messages file. <IP address> is the IP address of the Event Collector.

Step 7 Save and exit the file. Step 8 Send a hang-up signal to the syslog daemon to make sure all changes are

enforced:

kill -HUP `cat /var/run/syslog.pid`

Configuring DSMs

Page 46

30 BRIDGEWATER

Step 9 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Bridgewater Systems device:

From the Log Source Type drop-down list box, select the Bridgewater

Systems AAA Service Controller option.

For more information on configuring log sources, see the Log Sources User Guide.

For more information about your Bridgewater system device, see your vendor

documentation.

Configuring DSMs

Page 47

CA TECHNOLOGIES

This section provides information on the following DSMs:

• CA ACF2

• CA Top Secret

CA ACF2 The CA Access Control Facility (ACF2) DSM allows you to use an IBM mainframe

to collect events and audit transactions. SIEM retrieves archived log files from a remote host using the log file protocol and records all relevant information from the event.

To integrate CA ACF2 events into SIEM:

1 The IBM mainframe records all security events as Service Management

Framework (SMF) records in a live repository.

2 The CA ACF2 data is extracted from the live repository using the SMF dump utility.

The SMF file contains all of the event s and fields from the previous day in raw SMF format.

Configuring CA ACF2

to Integrate with

SIEM

Step 1 From the Enterasys Extr anet website, download the following compressed file:

Step 2 On a Linux-based operating system, extract the file:

3 The QexACF2.load.trs program pulls data from the SMF formatted file. The

QexACF2.load.trs program only pulls the relevant events and fields for SIEM

and writes that information in a condensed format for SIEM compatibility. The information is saved in a location accessible by SIEM.

4 SIEM uses the log file protocol source to retrieve the output file information for

SIEM on a scheduled basis. SIEM then imports and processes this file. This document includes:

• Configuring CA Top Secret to Integrate with SIEM

• Pulling Data Using Log File Protocol

To integrate CA ACF2 with SIEM:

qexacf2_bundled.tar.gz

Configuring DSMs

Page 48

32 CA TECHNOLOGIES

NOTE

Step 3 Load the files onto the IBM mainframe using the following methods:

tar -zxvf qexacf2_bundled.tar.gz

The following files are contained in the archive:

QexACF2.JCL.txt - Job Control Language file

QexACF2.load.trs - Compressed program library (requires IBM TRSMAIN)

trsmain sample JCL.txt - Job Control Language for TRSMAIN to decompress the

.trs file

a Upload the sample QexACF2_trsmain_JCL.txt and QexACF2.JCL.txt files

using the TEXT protocol.

b Upload the QexACF2.load.trs file using a BINARY mode transfer and

append to a pre-allocated data set. The

QexACF2.load.trs file is a tersed file

containing the executable (the mainframe program QexACF2). When you upload the .trs file from a workstation, pre-allocate a file on the mainframe with the following DCB attributes: DSORG=PS, RECFM=FB, LRECL=1024, BLKSIZE=6144. The file transfer type must be binary and not text.

QexACF2 is a small C mainframe program that reads the output of the TSSUTIL (EARLOUT data) line by line. QexACF2 adds a header to each record containing event information, for example, record descriptor, the date, and time. The program places each field into the output record, suppresses trailing blank characters, and delimits each field with the pipe character. This output file is form atted for SIEM and the blank suppression reduces network traffic to SIEM. This program does not consume CPU or I/O disk resources.

Step 4 Customize the trsmain sample_JCL.txt file according to your

installation-specific parameters.

For example, jobcard, data set naming conventions, output destinations, retention

periods, and space requirements.

trsmain sample_JCL.txt file uses the IBM utility TRSMAIN to extract the

The

program stored in the

An example of the

//TRSMAIN JOB (yourvalidjobcard),Q1labs,

// MSGCLASS=V

//DEL EXEC PGM=IEFBR14

//D1 DD DISP=(MOD,DELETE),DSN=<yourhlq>.QEXACF2.LOAD.TRS

// UNIT=SYSDA,

// SPACE=(CYL,(10,10))

//TRSMAIN EXEC PGM=TRSMAIN,PARM='UNPACK'

//SYSPRINT DD SYSOUT=*,DCB=(LRECL=133,BLKSIZE=12901,RECFM=FBA)

//INFILE DD DISP=SHR,DSN=<yourhlq>.QEXACF2.LOAD.TRS

//OUTFILE DD DISP=(NEW,CATLG,DELETE),

// DSN=<yourhlq>.LOAD,

// SPACE=(CYL,(10,10,5),RLSE),UNIT=SYSDA

QexACF2.load.trs file.

QexACF2_trsmain_JCL.txt file includes:

Configuring DSMs

Page 49

CA ACF2 33

The .trs input file is an IBM TERSE formatted library and is extracted by running the JCL, which calls the TRSMAIN. This tersed file, when extracted, creates a PDS linklib with the

Step 5 You can STEPLIB to this library or choose to move the program to one of the

QexACF2 program as a member.

LINKLIBs that are in LINKLST. The program does not require authorization.

Step 6 After uploading, copy the program to an existing link listed library or add a

STEPLIB DD statement with the correct dataset name of the library that will contain the program.

Step 7 The QexACF2_jcl.txt file is a text file containing a sample JCL. You must

configure the job card to meet your configuration.

QexACF2_jcl.txt sample file includes:

The

//QEXACF2 JOB (T,JXPO,JKSD0093),DEV,NOTIFY=Q1JACK, // MSGCLASS=P, // REGION=0M //* //*QEXACF2 JCL VERSION 1.0 OCTOBER, 2010 //* //************************************************************ //* Change below dataset names to sites specific datasets names*

//************************************************************ //SET1 SET SMFIN='MVS1.SMF.RECORDS(0)', // QEXOUT='Q1JACK.QEXACF2.OUTPUT', // SMFOUT='Q1JACK.ACF2.DATA' //************************************************************ //* Delete old datasets * //************************************************************ //DEL EXEC PGM=IEFBR14 //DD1 DD DISP=(MOD,DELETE),DSN=&SMFOUT, // UNIT=SYSDA, // SPACE=(CYL,(10,10)), // DCB=(RECFM=FB,LRECL=80) //DD2 DD DISP=(MOD,DELETE),DSN=&QEXOUT, // UNIT=SYSDA, // SPACE=(CYL,(10,10)), // DCB=(RECFM=FB,LRECL=80) //************************************************************* //* Allocate new dataset * //************************************************************* //ALLOC EXEC PGM=IEFBR14 //DD1 DD DISP=(NEW,CATLG),DSN=&QEXOUT, // SPACE=(CYL,(100,100)), // DCB=(RECFM=VB,LRECL=1028,BLKSIZE=6144) //************************************************************* //* Execute ACFRPTPP (Report Preprocessor GRO) to extract ACF2* //* SMF records * //*************************************************************

Configuring DSMs

Page 50

34 CA TECHNOLOGIES

//PRESCAN EXEC PGM=ACFRPTPP

//SYSPRINT DD SYSOUT=*

//SYSUDUMP DD SYSOUT=*

//RECMAN1 DD DISP=SHR,DSN=&SMFIN

//SMFFLT DD DSN=&SMFOUT,SPACE=(CYL,(100,100)),DISP=(,CATLG),

// DCB=(RECFM=FB,LRECL=8192,BLKSIZE=40960),

// UNIT=SYSALLDA

//************************************************************

//* execute QEXACF2 *

//************************************************************

//EXTRACT EXEC PGM=QEXACF2,DYNAMNBR=10,

// TIME=1440

//STEPLIB DD DISP=SHR,DSN=Q1JACK.C.LOAD

//SYSTSIN DD DUMMY

//SYSTSPRT DD SYSOUT=*

//SYSPRINT DD SYSOUT=*

//CFG DD DUMMY

//ACFIN DD DISP=SHR,DSN=&SMFOUT

//ACFOUT DD DISP=SHR,DSN=&QEXOUT

//************************************************************

//FTP EXEC PGM=FTP,REGION=3800K

//INPUT DD *

<USER>

PUT '<ACFOUT>' EARL_<THEIPOFTHEMAINFRAMEDEVICE>/<ACFOUT>

QUIT

//OUTPUT DD SYSOUT=*

//SYSPRINT DD SYSOUT=*

//*

Step 8 After the output file is created, you must choose one of the following options:

a Schedule a job to a transfer the output file to an interim FTP server.

Each time the job completes, the output file is forwarded to an interim FTP server. You must configure the following parameters in the sample JCL to successfully forward the output to an interim FTP server:

For example:

//FTP EXEC PGM=FTP,REGION=3800K //INPUT DD * <IPADDR> <USER> <PASSWORD> PUT '<ACFOUT>' EARL_<THEIPOFTHEMAINFRAMEDEVICE>/<ACFOUT> QUIT //OUTPUT DD SYSOUT=* //SYSPRINT DD SYSOUT=*

Configuring DSMs

Page 51

CA ACF2 35

Where:

<IPADDR> is the IP address or host name of the interim FTP server to receive

the output file.

<USER> is the user name required to access the interim FTP server. <PASSWORD> is the password required to access the interim FTP server. <THEIPOFTHEMAINFRAMEDEVICE> is the destination of the mainframe or

interim FTP server receiving the output. For example:

PUT 'Q1JACK.QEXACF2.OUTPUT.C320' /192.168.1.101/ACF2/QEXACF2. OUTPUT.C320

Pulling Data Using

Log File Protocol

is the name of the output file saved to the interim FTP server.

You are now ready to configure the Log File protocol. See Pulling Data Using

Log File Protocol.

b Schedule SIEM to retrieve the output file from CA ACF2.

If the zOS platform is configured to serve files through FTP , SFTP, or allow SCP, then no interim FTP server is required and SIEM can pull the output file directly from the mainframe. The following text must be commented out using //* or deleted from the

//FTP EXEC PGM=FTP,REGION=3800K //INPUT DD * <IPADDR> <USER> <PASSWORD> PUT '<ACFOUT>' EARL_<THEIPOFTHEMAINFRAMEDEVICE>/<ACFOUT> QUIT //OUTPUT DD SYSOUT=* //SYSPRINT DD SYSOUT=*

QexACF2_jcl.txt file:

You are now ready to configure the Log File protocol. See Pulling Data Using

Log File Protocol.

A log file protocol source allows SIEM to retrieve archived log files from a remote host. The CA ACF2 DSM supports the bulk loading of log files using the log file protocol source.

When configuring your CA ACF2 DSM to use the log file protocol, make sure the hostname or IP address configured in the CA ACF2 is the same as con fig ured in the Remote Host parameter in the Log File protocol configuration.

Configuring DSMs

Page 52

36 CA TECHNOLOGIES

You are now ready to configure the log source and log file protocol in SIEM:

To configure SIEM to re ceive events from the CA ACF2:

Step 1 From the Log Source Type drop-down list box, select the CA ACF2 option. Step 2 From the Protocol Configuration drop-down list box, select the Log File protocol

option.

Step 3 Configure the log file protocol options.

For more information on configuring log sources and protocols, see the Log

Sources User Guide.

CA Top Secret The CA Top Secret DSM allows you to integrate with an IBM zOS mainframe to

collect events and audit transactions. SIEM records all relevant and available

information from the event.

To integrate CA Top Secret events into SIEM:

1 The IBM mainframe records all security events as Service Management

Framework (SMF) records in a live repository.

Configuring CA Top

Secret to Integrate

with SIEM

Step 1 From the Enterasys Extranet website, download the following compressed file:

Step 2 On a Linux-based operating system, extract the file:

2 At midnight, the CA Top Secret data is extracted from the live repository usin g the

SMF dump utility. The SMF file contains all of the events and fields from the

previous day in raw SMF format.

3 The qextopsloadlib program pulls data from the SMF formatted file. The

qextopsloadlib program only pulls the relevant events and fields for SIEM and

writes that information in a condensed format for SIEM compatibility. The

information is saved in a location accessible by SIEM.

4 SIEM uses the log file protocol source to retrieve the output file information for

SIEM on a scheduled basis. SIEM then imports and processes this file.

This document includes:

• Configuring CA Top Secret to Integrate with SIEM

• Pulling Data Using Log File Protocol

To integrate CA Top Secret with SIEM:

qextops_bundled.tar.gz

tar -zxvf qextops_bundled.tar.gz

The following files are contained in the archive:

qextops_jcl.txt

Configuring DSMs

Page 53

CA Top Secret 37

NOTE

qextopsloadlib.trs

qextops_trsmain_JCL.txt

Step 3 Load the files onto the IBM mainframe using any terminal emulator file transfer

method.

a Upload the sample qextops_trsmain_JCL.txt and qextops_jcl.txt files

using the TEXT protocol.

b Upload the qextopsloadlib.trs file using a BINARY mode transfer. The

qextopsloadlib.trs file is a tersed file containing the executable (the

mainframe program qextops). When you upload the .trs file from a workstation, pre-allocate a file on the mainframe with the following DCB attributes: DSORG=PS, RECFM=FB, LRECL=1024, BLKSIZE=6144. The file transfer type must be binary and not text.

Qextops is a small C mainframe program that reads the output of the TSSUTIL (EARLOUT data) line by line. Qextops adds a header to each record containing event information, for example, record descriptor, the date, and time. The program places each field into the output record, suppresses trailing blank characters, and delimits each field with th e pipe character. This output file is formatted for SIEM and the blank suppression reduces network traffic to SIEM. This program does not consume CPU or I/O disk resources.

Step 4 Customize the qextops_trsmain_JCL.txt file according to your

installation-specific requirements.

qextops_trsmain_JCL.txt file uses the IBM utility TRSMAIN to extract the

The program stored in the

An example of the

//TRSMAIN JOB (yourvalidjobcard),Q1labs, // MSGCLASS=V //DEL EXEC PGM=IEFBR14 //D1 DD DISP=(MOD,DELETE),DSN=<yourhlq>.QEXTOPS.TRS // UNIT=SYSDA, // SPACE=(CYL,(10,10)) //TRSMAIN EXEC PGM=TRSMAIN,PARM='UNPACK' //SYSPRINT DD SYSOUT=*,DCB=(LRECL=133,BLKSIZE=12901,RECFM=FBA) //INFILE DD DISP=SHR,DSN=<yourhlq>.QEXTOPS.TRS //OUTFILE DD DISP=(NEW,CATLG,DELETE), // DSN=<yourhlq>.LOAD, // SPACE=(CYL,(10,10,5),RLSE),UNIT=SYSDA //

qextopsloadlib.trs file.

qextops_trsmain_JCL.txt file includes:

You must update the file with your installation specific information for parameters, for example, jobcard, data set naming conventions, output destinations, retention periods, and space requirements.

The .trs input file is an IBM TERSE formatted library and is extracted by running the JCL, which calls the TRSMAIN. This tersed file, when extracted, creates a PDS linklib with the

qextops program as a member.

Configuring DSMs

Page 54

38 CA TECHNOLOGIES

Step 5 You can STEPLIB to this library or choose to move the program to one of the

Step 6 After uploading, copy the program to an existing link listed librar y or ad d a

Step 7 The qextops_jcl.txt file is a text file containing a sample JCL. You must

LINKLIBs that are in the LINKLST. The program does not requir e authorization.

STEPLIB DD statement with the correct dataset name of the library that will

contain the program.

configure the job card to meet your configuration.

qextops_jcl.txt sample file includes:

The

//QEXTOPS JOB (T,JXPO,JKSD0093),DEV,NOTIFY=Q1JACK,

// MSGCLASS=P,

// REGION=0M

//*

//*QEXTOPS JCL version 1.0 September, 2010

//*

//*************************************************************

//* Change below dataset names to sites specific datasets names*

//************************************************************

//SET1 SET TSSOUT='Q1JACK.EARLOUT.ALL',

// EARLOUT='Q1JACK.QEXTOPS.PROGRAM.OUTPUT'

//************************************************************

//* Delete old datasets *

//************************************************************

//DEL EXEC PGM=IEFBR14

//DD1 DD DISP=(MOD,DELETE),DSN=&TSSOUT,

// UNIT=SYSDA,

// SPACE=(CYL,(10,10)),

// DCB=(RECFM=FB,LRECL=80)

//DD2 DD DISP=(MOD,DELETE),DSN=&EARLOUT,

// UNIT=SYSDA,

// SPACE=(CYL,(10,10)),

// DCB=(RECFM=FB,LRECL=80)

//************************************************************

//* Allocate new dataset *

//************************************************************

//ALLOC EXEC PGM=IEFBR14

//DD1 DD DISP=(NEW,CATLG),DSN=&EARLOUT,

// SPACE=(CYL,(100,100)),

// DCB=(RECFM=VB,LRECL=1028,BLKSIZE=6144)

//************************************************************

//* Execute Top Secret TSSUTIL utility to extract smf records*

//************************************************************

//REPORT EXEC PGM=TSSUTIL

//SMFIN DD DISP=SHR,DSN=&SMFIN1

//SMFIN1 DD DISP=SHR,DSN=&SMFIN2

//UTILOUT DD DSN=&UTILOUT,

// DISP=(,CATLG),UNIT=SYSDA,SPACE=(CYL,(50,10),RLSE),

// DCB=(RECFM=FB,LRECL=133,BLKSIZE=0)

Configuring DSMs

Page 55

CA Top Secret 39

//EARLOUT DD DSN=&TSSOUT, // DISP=(NEW,CATLG),UNIT=SYSDA, // SPACE=(CYL,(200,100),RLSE), // DCB=(RECFM=VB,LRECL=456,BLKSIZE=27816) //UTILIN DD *

NOLEGEND

REPORT EVENT(ALL) END /* //************************************************************ //EXTRACT EXEC PGM=QEXTOPS,DYNAMNBR=10, // TIME=1440 //STEPLIB DD DISP=SHR,DSN=Q1JACK.C.LOAD //SYSTSIN DD DUMMY //SYSTSPRT DD SYSOUT=* //SYSPRINT DD SYSOUT=* //CFG DD DUMMY //EARLIN DD DISP=SHR,DSN=&TSSOUT //EARLOUT DD DISP=SHR,DSN=&EARLOUT //************************************************************ //FTP EXEC PGM=FTP,REGION=3800K //INPUT DD * <IPADDR> <USER> <PASSWORD> PUT '<EARLOUT>' EARL_<THEIPOFTHEMAINFRAMEDEVICE>/<EARLOUT> QUIT //OUTPUT DD SYSOUT=* //SYSPRINT DD SYSOUT=*

Step 8 After the output file is created, you must choose one of the following options:

a Schedule a job to a transfer the output file to an interim FTP server.

Each time the job completes, the output file is forwarded to an intermin FTP server. You must configure the following parameters in the sample JCL to successfully forward the output to an interim FTP server:

For example:

//FTP EXEC PGM=FTP,REGION=3800K //INPUT DD * <IPADDR> <USER> <PASSWORD> PUT '<EARLOUT>' EARL_<THEIPOFTHEMAINFRAMEDEVICE>/<EARLOUT> QUIT //OUTPUT DD SYSOUT=* //SYSPRINT DD SYSOUT=*

Where:

<IPADDR> is the IP address or host name of the interim FTP server to receive

the output file.

Configuring DSMs

Page 56

40 CA TECHNOLOGIES

interim FTP server receiving the output. For example:

PUT 'Q1JACK.QEXTOPS.OUTPUT.C320' /192.168.1.101/CA/QEXTOPS.OU TPUT.C320

Pulling Data Using

Log File Protocol

is the name of the output file saved to the interim FTP server.

You are now ready to configure the Log File protocol. See Pulling Data Using

Log File Protocol.

b Schedule SIEM to retrieve the output file from CA Top Secret.

//FTP EXEC PGM=FTP,REGION=3800K //INPUT DD * <IPADDR> <USER> <PASSWORD> PUT '<EARLOUT>' EARL_<THEIPOFTHEMAINFRAMEDEVICE>/<EARLOUT> QUIT //OUTPUT DD SYSOUT=* //SYSPRINT DD SYSOUT=*

qextops_jcl.txt file:

You are now ready to configure the Log File protocol. See Pulling Data Using

Log File Protocol.

A log file protocol source allows SIEM to retrieve archived log files from a remote host. The CA Top Secret DSM supports the bulk loading of log files using the log file protocol source.

When configuring your CA Top Secret DSM to use the log file protocol, make sure the hostname or IP address configured in the CA Top Secret is the same as configured in the Remote Host parameter in the Log File Protocol configuration. For more information, see the Log Sources User Guide.

You are now ready to configure the log source and log file protocol in SIEM: To configure SIEM to receive events from the CA Top Secret:

Step 1 From the Log Source Type drop-down list box, select the CA Top Secret option. Step 2 From the Protocol Configuration drop-down list box, select the Log File protocol

option.

Step 3 Configure the log file protocol options.

Configuring DSMs

Page 57

CA Top Secret 41

For more information on configuring log sources and protocols, see the Log Sources User Guide.

Configuring DSMs

Page 58

Page 59

NOTE

CHECK POINT

This section provides information on the following DSMs:

• Check Point FireWall-1

• Check Point Provider-1

Check Point FireWall-1

Integrating Check

Point FireWall-1

Using Syslog

You can configure SIEM to integrate with a Check Point FireWall-1 device using one of the following methods:

• Integrating Check Point FireWall-1 Using Syslog

• Integrating Check Point FireWall-1 Using OPSEC

Depending on your Operating System, the proced ures for the Check Point FireWall-1 device may vary. The following procedures are based on the Check Point SecurePlatform Operating system.

This section describes how to ensure that the SIEM Check Point FireWall-1 DSMs accepts FireWall-1 events using syslog.

If Check Point SmartCenter is installed on Microsoft Windows, you must integrate Check Point with SIEM using OPSEC. For more information, see Integrating

Check Point FireWall-1 Using OPSEC.

Before you configure SIEM to integrate with a Check Point FireWall-1 device:

Step 1 Type the following command to access the Check Point console as an expert user:

expert

A password prompt is displayed.

Step 2 Type your expert console password. Press the Enter key. Step 3 Open the fo llowing file:

/etc/rc.d/rc3.d/S99local

Step 4 Add the following lines:

Configuring DSMs

Page 60

44 CHECK POINT

$FWDIR/bin/fw log -ftn | /usr/bin/logger -p <facility>.<priority> > /dev/null 2>&1 &

Where:

<facility> is a Syslog facility, for example, local3. <priority> is a Syslog priority, for example, info.

For example:

$FWDIR/bin/fw log -ftn | /usr/bin/logger -p local3.info > /dev/null 2>&1 &

Step 5 Save and close the file. Step 6 Open the syslog .conf file. Step 7 Add the following line:

facility>.<priority> <TAB><TAB>@<host>

< Where:

facility> is the syslog facility, for example, local3. This value must match the

< value you typed in Step 4.

priority> is the syslog priority, for example, info or notice. This value must

< match the value you typed in Step 4.

TAB> indicates you must press the Tab key.

host> indicates the SIEM managed host.

Step 8 Save and close the file. Step 9 Depending on your operating system, type the following command to restart

syslog: In Linux:

service syslog restart

In Solaris: /etc/init.d/syslog start

Step 10 Type the following command:

nohup $FWDIR/bin/fw log -ftn | /usr/bin/logger -p <facility>.<priority> > /dev/null 2>&1 &

Where:

<facility> is a Syslog facility, for example, local3. This value must match the

value you typed in Step 4

is a Syslog priority, for example, info. This value must match the

value you typed in Step 4

Step 11 You are now ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a Check Point Firewall-1 device:

Step 1 From the Log Source Type drop-down list box, select Check Point FireWall-1. Step 2 From the Protocol Configuration drop-down list box, select Syslog.

Configuring DSMs

Page 61

Check Point FireWall-1 45

For more information on configuring log sources, see the Log Sources User Guide. For more information about Check Point FireWall-1, see the Check Point

FireWall-1 documentation.

Integrating Check

Point FireWall-1

Using OPSEC

This section describes how to ensure that the SIEM Check Point FireWall-1 DSM accepts events using Open Platform for Security (OPSEC/LEA). When integrating Check Point OPSEC/LEA with SIEM, you must create two Secure Internal Communication (SIC) files and enter the information in to SIEM as a Check Point Firewall-1 log source.

To integrate Check Point Firewall-1 with SIEM, you must complete the following procedures in sequence:

• Add SIEM as a host for Check Point FireWall-1. See Adding a Check Point

FireWall-1 Host.

• Add an OPSEC application to Check Point Firewall-1. See Creating an OPSEC

Application Object.

• Locate the Log Source Secure Internal Communications DN. See Locate the

Log Source SIC.

• In SIEM, configure the OPSEC LEA protocol. See Configuring SIEM

OPSEC/LEA Parameters.

• Verify the OPSEC/LEA communications configuration. See Verifying or

Changing the OPSEC Communications Configuration.

Adding a Check Point FireWall-1 Host

To add SIEM as a host in Check Point FireWall-1 SmartCenter:

Step 1 Log in to the Check Point SmartDashboard user interface. Step 2 Select Manage > Network Objects > New > Node > Host. Step 3 Type parameters for your Check Point Firewall-1 host:

Name:

SIEM

IP Address: <IP address of SIEM system or Event Processor> Comment: <Optional>

Step 4 Click OK. Step 5 Select Close.

You are now ready to create an OPSEC Application Object for Check Point Firewall-1. See Creating an OPSEC Application Object.

Configuring DSMs

Page 62

46 CHECK POINT

NOTE

Creating an OPSEC Application Object

To create the OPSEC Application Object:

Step 1 Open the Che ck Point SmartDashboard user interface. Step 2 Select Manage > Servers and OPSEC applications > New > OPSEC

Application Properties.

Step 3 Assign a name to the OPSEC Application Object.

For example:

SIEM-OPSEC

The OPSEC Application Object name must be different than the host name you typed when creating the node in Step 3.

a From the Host drop-down list box, select SIEM. b From the Vendor drop-down list box, select User Defined. c In Client Entities, select the LEA check box. d To generate a Secure Internal Communication (SIC) DN, click

Communication.

e Enter an activation key.

The activation key is a password used to generate the SIC DN. When you configure your Check Point log source in SIEM, the activation key is typed into the Pull Certificate Password parameter.

f Click Initialize.

The window updates the Trust state from

but trust not established

g Click Close.

The OPSEC Application Properties window is displayed.

h Write down or copy the displayed SIC DN to a text file.

The displayed SIC value is required for th e OPSEC Application Object SIC Attribute parameter w h en you configure the Check P oint log source in SIEM. The OPSEC Application Object SIC resembles the following example: CN=SIEM-OPSEC,O=cpmodule..tdfaaz.

You are now ready to locate the log source SIC for Check Point Firewall-1. See

Locate the Log Source SIC.

Locate the Log Source SIC

To locate the Log Source SIC from the Check Point SmartDashboard:

Step 1 Select Manage > Network Objects.

Uninitialized to Initilialized

Step 2 Select your Check Point Log Host object.

Configuring DSMs

Page 63

NOTE

You must know if the Check Point Log Host is a separate object in your

NOTE

configuration from the Check Point Management Server. In most cases, the Check Point Log Host is the same object as the Check Point Management Server.

Step 3 Click Edit.

The Check Point Host General Properties window is displayed.

Step 4 Copy the Secure Internal Communication (SIC).

Depending on your Check Point version, the Communication button may not be available to display the SIC attribute. You may be required to locate the SIC attribute from the Check Point Management Server command line interface. You must use the

cpca_client lscert command from the command line interface

of the Management Server to display all certificates. The Log Source SIC Attribute resembles the following example: cn=cp_mgmt,o=cpmodule…tdfaaz. For more information, see your Check Point Command Line Interface Guide.

You must now install the Security Policy from the Check Point SmartDashboard user interface.

Step 5 Select Policy > Install > OK.

Check Point FireWall-1 47

You are now ready to configure the OPSEC LEA protocol. See Configuring SIEM

OPSEC/LEA Parameters.

Configuring SIEM OPSEC/LEA Parameters

To configure the log source in SIEM, you must:

Step 1 Log in to SIEM. Step 2 Click the Admin tab. Step 3 In the navigation menu, click Data Sources.

The Data Sources panel is displayed.

Step 4 Click the Log Sources icon.

The Log Sources window is displayed.

Step 5 Click Add.

The Add a log source window is displayed.

Step 6 From the Log Source Type drop-down list box, select Check Point FireWall-1. Step 7 Using the Protocol Configuration drop-down list box, select OPSEC/LEA.

The OPSEC/LEA protocol parameters appear.

Step 8 Configure the following values:

a Log Source Name - Type a name for the log source. a Log Source Identifier - Type the IP address for the log source. This value must

match the value you typed in the Server IP parameter.

Configuring DSMs

Page 64

48 CHECK POINT

b Server IP - Type the IP address of the Check Point host or Check Point

Management Server IP.

c Server Port - Type the port used for OPSEC/LEA. The default is 18184.

You must ensure the existing firewall policy permits the LEA/OPSEC connection from your SIEM host or SIEM Event Processor.

d OPSEC Application Object SIC Attribute - Type the SIC DN of the OPSEC

Application Object displayed in Creating an OPSEC Application Object - Step h.

e Log Source SIC Attribute - Type the SIC name for the server generating log

sources from Locate the Log Source SIC - Step 4. SIC attribute names can be up to 255 characters in length and are case

sensitive.

f Specify Certificate - Ensure the Specify Certificate check box is clear. g Pull Certificate Password - Type the activation key password from Creating

an OPSEC Application Object - Step e.

h Certificate Authority IP - Type the Check Point Manager Server IP address. i OPSEC Application - Type the name of the application requesting a certificate.

For example:

Step 9 Click Save.

Step 10 On the Admin tab, click Deploy Changes.

Verifying or

Changing the OPSEC

Communications

Configuration

If the value is Application value is

CN=SIEM-OPSEC,O=cpmodule...tdfaaz, the OPSEC

SIEM-OPSEC.

For more information on the OPSEC/LEA parameters, see the Log Sources User Guide.

You are now ready to verify your OPSEC/LEA communications for Check Point Firewall-1. See Verifying or Changing the OPSEC Communications Configuration.

This section describes how to modify your Check Point FireWall-1 configuration to allow OPSEC communications on non-standard ports, configure communications in a clear text, un-authenticated stream, and verify the configuration in SIEM.

This section includes the following information:

• Changing the Default Port on which OPSEC LEA Communicates

• Configuring OPSEC LEA for Un-Encrypted Communications

Changing the Default Port on which OPSEC LEA Communicates

To change the default port on which OPSEC LEA communicates (that is, port

18184):

Step 1 At the command-line prompt of your Check Point SmartCenter Server, type the

following command to stop the firewall services:

cpstop

Configuring DSMs

Page 65

Check Point FireWall-1 49

Step 2

Depending on your Check Point SmartCenter Server’s operating system, open the following file:

In Linux:

$FWDIR\conf\fwopsec.conf

In Windows: %FWDIR%\conf\fwopsec.conf The default contents of this file are as follows:

# The VPN-1/FireWall-1 default settings are: # # sam_server auth_port 0 # sam_server port 18183 # # lea_server auth_port 18184 # lea_server port 0 # # ela_server auth_port 18187 # ela_server port 0 # # cpmi_server auth_port 18190 # # uaa_server auth_port 19191 # uaa_server port 0 #

Step 3 Change the default lea_server auth_port from 18184 to another port number. Step 4 Remove the hash (#) mark from that line.

For example:

lea_server auth_port 18888 # lea_server port 0

Step 5 Save and close the file. Step 6 Type the following command to start the firewall services:

cpstart

Configuring OPSEC LEA for Un-Encrypted Communications

To configure the OPSEC LEA protocol for un-encrypted communications:

Step 1 At the command-line prompt of your Check Point SmartCenter Server, stop the

firewall services by typing the following command:

cpstop

Step 2 Depending on your Check Point SmartCenter Server’s operating system, open the

following file: In Linux:

$FWDIR\conf\fwopsec.conf

In Windows: %FWDIR%\conf\fwopsec.conf

Step 3 Change the default lea_server auth_port from 18184 to 0. Step 4 Change the default lea_server port from 0 to 18184.

Configuring DSMs

Page 66

50 CHECK POINT

NOTE

Step 5 Remove the hash (#) marks from both lines.

For example:

lea_server auth_port 0 lea_server port 18184

Step 6 Save and close the file. Step 7 Type the following command to start the firewall services:

cpstart

Step 8 You are now ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a Check Point Firewall-1 device:

Step 1 From the Log Source Type drop-down list box, select Check Point FireWall-1. Step 2 From the Protocol Configuration drop-down list box, select OPSEC/LEA.

For more information on configuring log sources, see the Log Sources User Guide. For more information on configuring your Check Point Firewall-1, see your vendor

documentation.

Check Point Provider-1

Integrating Check

Point Provider-1

Using Syslog

You can configure SIEM to integrate with a Check Point Provider-1 device using one of the following methods:

• Integrating Check Point Provider-1 Using Syslog

• Integrating Check Point Provider-1 Using OPSEC

Depending on your Operating System, the proced ures for the Check Point Provider-1 device may vary. The following procedures are based on the Check Point SecurePlatform operating system.

This method ensures the SIEM Check Point Provider-1 DSM accepts Check Point Provider-1 events using syslog. SIEM records all relevant Check Point Provider-1 events.

Before you configure SIEM to integrate with a Check Point Provider-1 device, you must:

Step 1 Type the following command to access the console as an expert user:

expert

A password prompt is displayed.

Step 2 Type your expert console password. Press the Enter key. Step 3 Type the following command:

csh

Step 4 Select the desired custome r logs:

Configuring DSMs

Page 67

Check Point Provider-1 51

mdsenv <customer name>

Step 5 Type the following command:

# nohup $FWDIR/bin/fw log -ftn | /usr/bin/logger -p <facility>.<priority> 2>&1 &

Where:

<facility> is a Syslog facility, for example, local3. <priority> is a Syslog priority, for example, info.

Step 6 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Check Point Provider-1 device:

Step 1 From the Log Source Type drop-down list box, select Check Point Firewall-1. Step 2 From the Protocol Configuration drop-down list box, select Syslog.

For more information on configuring log sources, see the Log Sources User Guide. For more information about Check Point Provider-1, see the Check Point

Provider-1 documentation.

Integrating Check

Point Provider-1

Using OPSEC

Step 1 To create a host object, open the Check Point SmartDashboard user interface and

Step 2 Type the Name, IP Address, and optional Comment for your host. Step 3 Click OK. Step 4 Select Close.

This method ensures the SIEM Check Point Provider-1 DSM accepts Check Point Provider-1 events using OPSEC.

To enable Check Point Provider-1 and SIEM integration, you must:

1 Configure Check Point Provider-1 SmartCenter. For more information, see

Reconfiguring Check Point Provider-1 SmartCenter.

2 Configure the log source in SIEM. For more information, see Configuring the

Check Point Log Source.

Reconfiguring Check Point Provider-1 SmartCenter

This section describes how to reconfigure the Check Point Provider-1 SmartCenter. In the Check Point Provider-1 Management Domain GUI (MDG), create a host object representing the SIEM system. The leapipe is the connection between the Check Point Provider-1 and SIEM.

To reconfigure the Check Point Provider-1 SmartCenter (MDG):

select Manage > Network Objects > New > Node > Host.

Step 5 To create the OPSEC connection, select Manage > Servers and OPSEC

Applications New > OPSEC Application Properties.

Step 6 Type a name and optional comment.

Configuring DSMs

Page 68

52 CHECK POINT

The name you type must be different than the name used in Ste p 2.

Step 7 From the Host drop-down menu, select the SIEM host object that you just created. Step 8 From Application Properties, select User Defined as the Vendor type. Step 9 From Client Entries, select LEA.

Step 10 Configure the Secure Internal Communication (SIC) certificate, click

Communication and enter an activation key.

Step 11 Select OK and then Close. Step 12 To install the Policy on your firewall, select Policy > Install > OK.

Configuring the Check Point Log Source

To configure SIEM to re ceive events from a Check Point Provider-1 device:

Step 1 From the Log Source Type drop-down list box, select Check Point Firewall-1. Step 2 From the Protocol Configuration drop-down list box, select OPSEC/LEA.

For more information on configuring OPSEC/LEA, see the Log Sources User Guide.

Configuring DSMs

Page 69

CISCO

This section provides information on the following DSMs:

• Cisco ACE Firewall

• Cisco Aironet

• Cisco ACS

• Cisco ASA

• Cisco CatOS for Catalyst Switches

• Cisco CSA

• Cisco FWSM

• Cisco IDS/IPS

• Cisco IronPort

• Cisco NAC

• Cisco IOS

• Cisco Pix

• Cisco VPN 3000 Concentrator

• Cisco Wireless Services Module

Cisco ACE Firewall You can integrate a Cisco ACE firewall with SIEM. A Cisco ACE firewall DSM

accepts events using syslog. SIEM records all relevant events. Before you configure SIEM to integrate with an ACE firewall, you must forward all device logs to your SIEM system.

To forward Cisco ACE device logs to SIEM:

Step 1 Log in to your Cisco ACE device. Step 2 From the shell interface, select Main Menu > Advanced Options > Syslog

Configuration.

Step 3 The Syslog Configuration menu varies depending on whether there are any syslog

destination hosts configured yet. If no syslog destinations have been added, create one by selecting the Add First Server option. Click OK.

Configuring DSMs

Page 70

54 CISCO

Step 4 Type the hostname or IP address of the destination host and port in the First

Syslog Server field. Click OK.

The system restarts with new settings. When finished, the Syslog server window displays the host you have configured.

Step 5 Click OK.

The Syslog Configuration menu is displayed. Notice that options for editing the server configuration, removing the server, or adding a second server are now available.

Step 6 If you want to add another server, click Add Second Server.

At any time, click the View Syslog options to view existing server configurations.

Step 7 To return to the Advanced Menu, click Return. Step 8 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cisco ACE Firewall device:

From the Log Source Type drop-down list box, select the Cisco ACE

Firewall option.

For more information on configuring log sources, see the Log Sources User Guide. For more information on forwarding logs to SIEM, see your vendor documentation.

Cisco Aironet Y ou can integrate a Cisco Aironet device with SIEM. A Cisco Aironet DSM accepts

Cisco Emblem Format events using syslog. Before you configure SIEM to integrate with a Cisco Aironet device, you must:

Step 1 Establish a connection to the Cisco Aironet device using one of the following

methods”

• Telnet to the wireless access point

• Access the console

Step 2 Type the following command to access privileged EXEC mode:

enable

Step 3 Type the following command to access global configuration mode:

config terminal

Step 4 Type the following command to enable message logging:

logging on

Step 5 Configure the syslog facility. The default is local7.

logging facility <facility, for example, local7>

Step 6 Log message s to the SIEM host:

logging <IP address of your SIEM system>

Configuring DSMs

Page 71

Step 7 Enable timestamp on log messages:

service timestamp log datatime

Step 8 Return to privileged EXEC mode:

end

Step 9 View your entries:

show running-config

Step 10 Save your entries in the configuration file:

copy running-config startup-config

Step 11 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cisco ACS device:

From the Log Source Type drop-down list box, select Cisco Aironet.

For more information on configuring log sources, see the Log Sources User Guide. For more information about Cisco Aironet, see your vendor documentation.

Cisco ACS 55

Cisco ACS A SIEM Cisco ACS DSM accepts syslog ACS events using syslog. SIEM records

all relevant and available information from the event. You can integrate Cisco ACS with SIEM using one of the following methods:

• Configure your Cisco ACS device to directly send syslog to SIEM (Cisco ACS

software version 4.1 and later). See Configuring Syslog for Cisco ACS.

• A server using the SIEM Adaptive Log Exporter (Cisco ACS software version

3.x or later). See Configuring Cisco ACS for the Adaptive Log Expor ter.

Configuring Syslog

for Cisco ACS

Step 1 Log in to your Cisco ACS device user interface. Step 2 In the navigation bar, click System Configuration.

Step 3 Click Logging.

Step 4 In the Syslog column for Failed Attempts, click Configure.

Step 5 Select the Log to Syslog Failed Attempts report check box. Step 6 Add the following Logged Attributes:

To configure an ACS device in SIEM, you must:

The System Configuration page opens.

The logging configuration is displa ye d .

The Enable Logging window is displayed.

• Message-Type

• User-Name

Configuring DSMs

Page 72

56 CISCO

NOTE

• Nas-IP-Address

• Authen-Failure-Code

• Caller-ID

• NAS-Port

• Author-Data

• Group-Name

• Filter Information

• Logged Remotely

Step 7 Configur e the following syslog parameters:

• IP - Type the IP address of SIEM.

• Port - Type the syslog port number of SIEM. The default is port 514.

• Max message length (Bytes) - Type 1024 as the maximum syslog message

length.

Cisco ACS provides syslog report information for a maximum of two syslog servers.

Step 8 Click Submit. Step 9 You are now ready to configure the log source in SIEM.

Configuring Cisco

ACS for the Adaptive

Log Exporter

Step 1 Log in to your Cisco ACS device user interface. Step 2 In the navigation bar, click System Configuration.

Step 3 Click Logging.

Step 4 In the CSV column for Failed Attempts, click Configure.

SIEM automatically detects a Cisco ACS device. However, if you want to manually configure SIEM to receive events from Cisco ACS:

From the Log Source Type drop-down list box, select the Cisco ACS option.

For more information on configuring log sources, see the Log Sources User Guide. For more information about Cisco ACS, see your vendor documentation.

To configure your Cisco ACS device for th e Adaptive Log Exporter, you must:

The System Configuration page opens.

The logging configuration is displayed.

The Enable Logging window is displayed.

Step 5 Select the Log to CSV Failed Attempts report check box.

Configuring DSMs

Page 73

Step 6 Add the following Logged Attributes:

• Message-Type

• User-Name

• Nas-IP-Address

• Authen-Failure-Code

• Caller-ID

• NAS-Port

• Author-Data

• Group-Name

• Filter Information

• Logged Remotely

Step 7 Configure a time frame for Cisco ACS to generate a new csv file. Step 8 Click Submit. Step 9 You are now ready to configure the log source in SIEM.

You can integrate your Cisco ACS with SIEM using the SIEM Adaptive Log Exporter. The Adaptive Log Exporter reads the csv files in the Cisco ACS root log directory and forwards the events to SIEM using syslog. For more information on using the Adaptive Log Exporter, see the Adaptive Log Exporter Users Guide.

Cisco ASA 57

If you are not using the Adaptive Log Exporter, SIEM automatically detects the Cisco ACS events from the Adaptive Log Exporter. However, if you want to manually configure SIEM to receive events from Cisco ACS:

From the Log Source Type drop-down list box, select the Cisco ACS option.

For more information on configuring log sources, see the Log Sources User Guide.

For more information about Cisco ACS, see your vendor documentation.

Cisco ASA You can integrate a Cisco Adaptive Security Appliance (ASA) with SIEM. A Cisco

ASA DSM accepts events using syslog or NetFlow using NetFlow Security Event Logging (NSEL). SIEM records all relevant events. Before you configure SIEM, you must configure your Cisco ASA device to forward syslog or NetFlow NSEL events to SIEM.

Choose one of the following options:

• Forward events to SIEM using syslog. See Integrating Cisco ASA Using Syslog

• Forward events to SIEM using NetFlow NSEL. See Integrating Cisco ASA for

NetFlow using NSEL

Configuring DSMs

Page 74

58 CISCO

NOTE

Integrating Cisco

ASA Using Syslog

Step 1 Log in to the Cisco ASA device. Step 2 Type the following command to access privileged EXEC mode:

Step 3 Type the following command to access global configuration mode:

Step 4 Enable logging:

Step 5 Configure the logging details:

Step 6 Type the following command to configure logging to SIEM:

This section describes how to configure Cisco ASA to forward syslog events.

enable

conf t

logging enable

logging console warning logging trap warning logging asdm warning

logging host <interface> <IP address>

Where:

<interface> is the name of the Cisco Adaptive Security Appliance interface. <IP address> is the IP address of SIEM.

Using the command show interfaces displays all available interfaces for your Cisco device.

Step 7 Disable the output object name option:

no names

You must disable the output object name option to ensure that the logs use IP addresses and not object names.

Step 8 Exit the con figu ration:

exit

Step 9 Save the cha nges:

write mem

Step 10 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cisco ASA device:

From the Log Source Type drop-down list box, select the Cisco Adaptive

Security Appliance (ASA) option.

For more information on configuring log sources, see the Log Sources User Guide.

Configuring DSMs

Page 75

Cisco ASA 59

NOTE

For more information on forwarding NetFlow to SIEM, see your vendor documentation.

Integrating Cisco

ASA for NetFlow

using NSEL

Step 1 Log in to the Cisco ASA device command line interface (CLI). Step 2 Type the following command to access privileged EXEC mode:

Step 3 Type the following command to access global configuration mode:

Step 4 Disable the output object name option:

Step 5 Type the following command to enable NetFlow export:

This section describes how to configure Cisco ASA to forward NetFlow events using NSEL.

enable

conf t

no names

flow-export destination <interface-name> <ipv4-address or hostname> <udp-port>

Where:

<interface-name> is the name of the Cisco Adaptive Security Appliance

interface for the NetFlow collector.

<ipv4-address or hostname> is the IP address or host name of the Cisco

ASA device with the NetFlow collector application.

<udp-port> is the UDP port number to which NetFlow packets are sent.

SIEM typically uses port 2055 for NetFlow event data on Behavioral Flow Collectors. You must configure a different UDP port on your Cisco Adaptive Security Appliance for NetFlow using NSEL.

Step 6 Type the following command to configure the NSEL class-map:

class-map flow_export_class

Step 7 Choose one of the following traffic options:

a To configure a NetFlow access list to match specific traffic, type the command:

match access-list flow_export_acl

b To con figu re NetFlow to match any traffic, type the command:

match any

The Access Control List (ACL) must exist on the Cisco ASA device prior to defining the traffic match option in Step 7.

Step 8 Type the following command to configure the NSEL policy-map:

policy-map flow_export_policy

Configuring DSMs

Page 76

60 CISCO

NOTE

Step 9 Type the following command to define a class for the flow-export action:

class flow_export_class

Step 10 Type the following command to configure the flow-export action:

flow-export event-type all destination <IP address>

Where <IP address> is the IP address of SIEM.

If you are using a version of Cisco ASA prior to v8.3 you may skip Step 10 as the device defaults to the flow-export destination. For more information, see your Cisco ASA documentation.

Step 11 Type the following command to add the service policy globally:

service-policy flow_export_policy global

Step 12 Exit the configuration:

exit

Step 13 Save the changes:

write mem

You must verify that your collector applications use the Event Time field to correlate events.

Step 14 You are now ready to configure the log source and protocol in SIEM.

Step 1 From the Log Source Type drop-down list box, select Cisco Adaptive Security

Step 2 From the Protocol Configuration drop-down list box, select Cisco NSEL. For

Step 3 Your system must be running the latest version of the NSEL protocol to integrate

Cisco CatOS for Catalyst Switches

Step 1 Log in to your Cisco CatOS user interface. Step 2 Type the following command to access privileged EXEC mode:

To configure SIEM to receive events from a Cisco ASA device using NetFlow:

Appliance (ASA).

more information on configuring log sources, see the Log Sources User Guide.

with a Cisco ASA device using NetFlow NSEL. For more information on configuring NetFlow with your Cisco ASA device, see your

vendor documentation.

A SIEM Cisco CatOS for Catalyst Switches DSM accepts events using syslog. SIEM records all relevant device events. Before configuring a Cisco CatOS device in SIEM, you must configure your device to send syslog events to SIEM.

To configure the de vice to send syslog events to SIEM:

enable

Step 3 Configur e the system to timestamp messages:

Configuring DSMs

Page 77

Cisco CSA 61

set logging timestamp enable

Step 4 Type the IP address of the SIEM server:

set logging server <IP address>

Step 5 Limit messages that are logged by selecting a severity level:

set logging server severity <server severity level>

Step 6 Configure the facility level that should be used in the message. The default is

local7.

set logging server facility <server facility parameter>

Step 7 Enable the switch to send syslog messages to the SIEM server.

set logging server enable

Step 8 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cisco CatOS device:

From the Log Source Type drop-down list box, select the Cisco CatOS for

Catalyst Switches option.

For more information on configuring log sources, see the Log Sources User Guide.

Cisco CSA Y ou can integrate a Cisco Security Agent (CSA) server with SIEM. The Cisco CSA

DSM accepts events using syslog, SNMPv1, and SNMPv2. SIEM records all configured Cisco CSA alerts.

Before you configure SIEM to integrate with a CSA server, you must:

Step 1 Open the Cisco CSA user interface. Step 2 Select Events > Alerts. Step 3 Click New.

The Configuration View window is displayed.

Step 4 Type in values for the following parameters:

a Name - Type a name you wish to assign to your configuration. b Description - Type a description for the configuration. This parameter is

optional.

Step 5 From the Send Alerts, select the event set from the list box to generate alerts. Step 6 Select the SNMP check box. Step 7 Type a Community name.

The Community name entered in the CSA user int er fa ce must match the Community field configured on SIEM. This option is only available using the SNMPv2 protocol.

Step 8 In the Manager IP address parameter, type the IP address of SIEM.

Configuring DSMs

Page 78

62 CISCO

Step 9 Click Save.

For more information on forwarding logs to SIEM, see your vendor documentation.

Step 10 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cisco CSA device:

From the Log Source Type drop-down list box, select Cisco CSA.

For more information on configuring log sources, see the Log Sources User Guide.

Cisco FWSM You can integrate Cisco Firewall Service Module (FWSM) with SIEM. A SIEM

FWSM DSM accepts FWSM events using syslog. SIEM records all relevant Cisco FWSM events.

Before you configure SIEM to integrate with Cisco FWSM, you must configure Cisco FWSM to forward logs to SIEM:

Step 1 Using a Console connection, telnet, or SSH, log in to the Cisco FWSM. Step 2 Enable logging:

logging on

Step 3 Chan ge the logging level:

logging trap level (1-7)

By default, the logging level is set to 3 (error).

Step 4 Designate SIEM as a host to receive the message s:

logging host [interface] ip_address [tcp[/port] | udp[/port]] [format emblem]

For example:

logging host dmz1 192.168.1.5

Where 192.168.1.5 is the IP address of your SIEM system.

Step 5 You are now ready to configure the log source SIEM.

To configure SIEM to receive events from a Cisco IDS device:

From the Log Source Type drop-down list box, select the Cisco Firewall

Services Module (FWSM) option.

For more information on configuring log sources, see the Log Sources User Guide. For more information about Cisco FWSM devices, see your Cisco documentation.

Cisco IDS/IPS A Cisco IDS/IPS DSM polls the Cisco IDS/IPS events using the Security Device

Event Exchange (SDEE) protocol. SDEE specifies the message format and the protocol used to communicate the events generated by security devices. SIEM

Configuring DSMs

Page 79

Cisco IronPort 63

NOTE

only supports direct SDEE connections to the device and not the management software, which controls the device.

You must have security access or web authentication on the device before connecting to SIEM.

Once you configure your Cisco IDS/IPS device, you must configure the SDEE protocol in SIEM. When configuring the SDEE protocol, you must define the URL required to access the device.

For example,

https://www.mysdeeserver.com/cgi-bin/sdee-server.

You must use an http or https URL, which is specific to your Cisco IDS version:

• If you are using RDEP (for Cisco IDS v4.0), the URL should have

/cgi-bin/event-server at the end. For example:

https://www.my-rdep-server.com/cgi-bin/event-server

•

If you are using SDEE/CIDEE (for Cisco IDS v5.x and above), the URL should have /cgi-bin/sdee-server at the end. For example:

https://www.my-sdee-server/cgi-bin/sdee-server

To configure SIEM to receive events from a Cisco IDS/IPS device:

From the Log Source Type drop-down list box, select the Cisco Intrusion

Prevention System (IPS) option.

For more information on configuring devices, see the Log Sources User Guide. For more information about your Cisco IDS/IPS, see your vendor documentation.

Cisco IronPort A Cisco IronPort DSM integrates with SIEM to provide event information for email

spam, web content filtering, and corporate email policy enforcement. Before you configure SIEM to integrate with your Cisco IronPort device, you must select the log type to configure:

• To configure IronPort mail logs, see IronPort Mail Log Configuration.

• To configure IronPort content filtering logs, see IronPort Web Content Filter.

IronPort Mail Log

Configuration

Step 1 Log in to your Cisco IronPort user interface. Step 2 Select System Administration\Log Subscriptions. Step 3 Click Add Log Subscription. Step 4 Configure the following values:

A SIEM Cisco IronPort DSM accepts events using syslog. To configure your IronPort device to send syslog events to SIEM, you must:

• Log Type - Define a log subscription for both Ironport Text Mail Logs and

System Logs.

Configuring DSMs

Page 80

64 CISCO

• Log Name - Type a log name.

• File Name - Use the default configuration value.

• Maximum File Size - Use the default configuration value.

• Log Level - Select Information (Default).

• Retrieval Method - Select Syslog Push.

• Hostname - Type the IP address or server name of your SIEM system.

• Protocol - Select UDP.

• Facility - Use the default configuration value. This value depends on the

configured Log Type.

Step 5 Save the subscription. Step 6 You are now ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a Cisco IronPort device:

From the Log Source Type drop-down list box, select the Cisco IronPort

option.

For more information on configuring devices, see the Log Sources User Guide.

IronPort Web Content

Filter

Step 1 From the Log Source Type drop-down list box, select Cisco IronPort. Step 2 From the Protocol Configuration drop-down list box, select Log File protocol

Step 3 Select W3C as the Event Generator used to process the web content filter log

Step 4 The FTP File Pattern parameter must use a regular expression that matches the

For more information about your server, see your vendor documentation.

A SIEM Cisco IronPort DSM retrieves web content filtering events in W3C format from a remote source using the log file protocol. Your system must be running the latest version of log file protocol to integrate with a Cisco IronPort device. To configure your Cisco IronPort device to push web content filter events, you must configure a log subscription for the web content filter using the W3C format. For more information on configuring a log subscription, see your Cisco IronPort documentation.

You are now ready to configure the log source and protocol SIEM.

option.

files.

log files generated by the web content filter logs. For more information on configuring devices, see the Log Sources User Guide.

Cisco NAC A SIEM Cisco NAC DSM accepts events using syslog. SIEM records all relevant

audit, error, and failure events as well as quarantine and infected system events.

Configuring DSMs

Page 81

Cisco IOS 65

NOTE

Before configuring a Cisco NAC device in SIEM, you must configure your device to send syslog events to SIEM.

To configure the device to sen d syslog events to SIEM:

Step 1 Log in to the Cisco NAC user interface. Step 2 In the Monitoring section, select Event Logs. Step 3 Click the Syslog Settings tab. Step 4 In the Syslog Server Address field, type the IP address of your SIEM system. Step 5 In the Syslog Server Port field, type the syslog port. The default is 512. Step 6 In the System Health Log Interval field, type the frequency, in minutes, for

system statistic log events.

Step 7 Click Update. Step 8 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cisco NAC device:

From the Log Source T ype drop-dow n list box, select Cisco NAC Appliance.

For more information on configuring log sources, see the Log Sources User Guide.

Cisco IOS You can integrate Cisco IOS series devices with SIEM. A Cisco IOS DSM accepts

Cisco IOS events using syslog. SIEM records all relevant events.

Make sure all Access Control Lists (ACLs) are set to LOG.

Before you configure SIEM to integrate with a Cisco IOS server, you must:

Step 1 Type the following command to log in to the router in privileged-exec.

enable

Step 2 Type the following command to switch to configuration mode:

conf t

Step 3 Type the following commands:

logging <IP address> logging source-interface <interface>

Where:

IP address> is the IP address hosting SIEM and the SIM components.

<interface> is the name of the interface, for example, dmz, lan, ethernet0, or

ethernet1.

Step 4 Type the following to configure the priority level:

Configuring DSMs

Page 82

66 CISCO

logging trap warning logging console warning

Where warning is the priority setting for the logs.

Step 5 Configure the syslog facility:

logging facility syslog

Step 6 Save and exit the file. Step 7 Copy running-config to startup-config:

copy running-config startup-config

Step 8 You are now ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a Cisco IOS device:

From the Log Source Type drop-down list box, select one of the following

options based on your Cisco device: Cisco IOS, Cisco 12000 Series

Routers, Cisco 6500 Series Switches, Cisco 7600 Series Routers, Cisco Carrier Routing System, or Cisco Integrated Services Router.

The following devices are auto discovered by SIEM as Cisco IOS devices:

• Cisco 12000 Series Routers

• Cisco 6500 Series Switches

• Cisco 7600 Series Routers

• Cisco Carrier Routing System

• Cisco Integrated Services Router

For more information on configuring log sources, see the Log Sources User Guide. For more information about your Cisco IOS, see your Cisco IOS documentation.

Cisco Pix You can integrate Cisco Pix security appliances with SIEM. A Cisco Pix DSM

accepts Cisco Pix events using syslog. SIEM records all relevant Cisco Pi x events. Before you configure SIEM to integrate with Cisco Pix, you must configure Cisco

Pix to forward logs to SIEM using the following command:

logging host <interface> <IP address>

Where:

<interface> is the name of the interface, for example, dmz, lan, ethernet0, or

ethernet1.

IP address> is the IP address hosting SIEM and the SIM components.

Configuring DSMs

Page 83

Cisco VPN 3000 Concentrator 67

To integrate Cisco Pix:

Step 1 Log into the Cisco PIX using a console connection, telnet, or SSH. Step 2 Type the following command to access Privileged mode:

enable

Step 3 Type the following command to access Configuration mode:

conf t

Step 4 Enable logging and timestamp the logs:

logging on logging timestamp

Step 5 Set the log level:

logging trap warning

Step 6 Configure logging to SIEM:

logging host <interface> <ip address>

Where:

interface> is the name of the interface, for example, dmz, lan, ethernet0, or

< ethernet1.

Cisco VPN 3000 Concentrator

ip address> is the IP address hosting SIEM and the SIM components.

Step 7 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cisco PIX device:

From the Log Source T y pe drop-down list box, select the Cisco PIX Firewall

option. For more information on configuring log sources, see the Log Sources User Guide. For more information about Cisco Pix devices, see your Cisco documentation.

A SIEM Cisco VPN 3000 Concentrator DSM accepts Cisco VPN Concentrator events using syslog. SIEM records all relevant events. Before you configure SIEM to integrate with a Cisco VPN concentrator, you must:

Step 1 Log in to the Cisco VPN 3000 Concentrator command line interface (CLI). Step 2 Type the following command to add a syslog server to your configuration:

set logging server <IP address>

Where <IP address> is the IP address of SIEM or your Event Collector.

Step 3 Type the following command to enable system message logging to the configured

syslog servers:

set logging server enable

Step 4 Set the facility and severity level for syslog server messages:

Configuring DSMs

Page 84

68 CISCO

set logging server facility server_facility_parameter set logging server severity server_severity_level

Step 5 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cisco VPN Concentrator device:

From the Log Source Type drop-down list box, select Cisco VPN 3000

Series Concentrator.

For more information on configuring log sources, see the Log Sources User Guide. For more information about your Cisco VPN Concentrator, see your vendor

documentation.

Cisco Wireless Services Module

You can integrate a Cisc o Wireless Services Module (WiSM) device with SIEM. A Cisco WiSM DSM accepts events using syslog. Before you configure SIEM to integrate with a Cisco WiSM device, you must:

Step 1 Log in to the Cisco Wireless LAN Controller user interface. Step 2 Click Management > Logs > Config.

The Syslog Configuration window is displayed.

Step 3 In the Syslog Server IP Address field type the IP address of the SIEM host to

which you want to send the syslog messages. Click Add.

Step 4 Using the Syslog Level drop-down list box, set the severity level for filtering syslog

messages to the syslog servers using one of the following options:

• Emergencies - Severity level 0

• Alerts - Severity level 1 (Default)

• Critical - Severity level 2

• Errors - Severity level 3

• Warnings - Severity level 4

• Notifications - Severity level 5

• Informational - Severity level 6

• Debugging - Severity level 7

If you set a syslog level, only those messages whose severity level is equal or less than that level are sent to the syslog servers. For example, if you set the syslog level to Warnings (severity level 4), only those messages whose severity is between 0 and 4 are sent to the syslog servers.

Step 5 From the Syslog Facility drop-down list box, set the facility for outgoing syslog

messages to the syslog server using one of the following options:

• Kernel - Facility level 0

• User Process - Facility level 1

Configuring DSMs

Page 85

• Mail - Facility level 2

• System Daemons - Facility level 3

• Authorization - Facility level 4

• Syslog - Facility level 5 (default value)

• Line Printer - Facility level 6

• USENET - Facility level 7

• Unix-to-Unix Copy - Facility level 8

• Cron - Facility level 9

• FTP Daemon - Facility level 11

• System Use 1 - Facility level 12

• System Use 2 - Facility level 13

• System Use 3 - Facility level 14

• System Use 4 - Facility level 15

• Local Use 0 - Facility level 16

• Local Use 1 - Facility level 17

Cisco Wireless Services Module 69

• Local Use 2 - Facility level 18

• Local Use 3 - Facility level 19

• Local Use 4 - Facility level 20

• Local Use 5 - Facility level 21

• Local Use 6 - Facility level 22

• Local Use 7 - Facility level 23

Step 6 Click Apply . Step 7 From the Buffered Log Level and the Console Log Level drop-down list boxes,

select the severity level for log messages to the controller buffer and console using one of the following options:

Emergencies - Severity level 0 Alerts - Severity level 1 Critical - Severity level 2 Errors - Severity level 3 (default value) Warnings - Severity level 4 Notifications - Severity level 5 Informational - Severity level 6 Debugging - Severity level 7

If you set a logging level, only those messages whose severity is equal to or less than that level are logged by the controller. For example, if you set the logging level

Configuring DSMs

Page 86

70 CISCO

to Warnings (severity level 4), only those messages whose severity is between 0 and 4 are logged.

Step 8 Select the File Info check box if you want the message logs to include information

about the source file. The default value is enabled.

Step 9 Select the Proc Info check box if you want the message logs to include process

information. The default value is disabled.

Step 10 Select the Trace Info check box if you want the message logs to include traceback

information. The default value is disabled.

Step 11 Click Apply to commit your changes. Step 12 Click Save Configuration to save your changes. Step 13 You are now ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a Cisco WiSM device:

From the Log Source Type drop-down list box, select the Cisco Wireless

Services Module (WiSM).

For more information on configuring log sources, see the Log Sources User Guide. For more information about Cisco WiSM, see your vendor documentation.

Configuring DSMs

Page 87

CITRIX NETSCALER

A SIEM Citrix NetScaler DSM accepts events using syslog. SIEM records all relevant audit log events from Citrix NetScaler.

Before you configure SIEM to integrate with Citrix NetScaler, you must:

Step 1 Log in to your Citrix NetScaler device as a roo t user. Step 2 Type the following command to add a remote syslog server:

add audit syslogAction <ActionName> <IP Address> -serverPort 514

-logLevel Info -dateFormat DDMMYYYY

Where:

<ActionName> is a descriptive name for the syslog server action. <IP Address> is the IP address or hostname of your SIEM system.

For example:

add audit syslogAction action-SIEM 10.10.10.10 -serverPort 514

-logLevel Info -dateFormat DDMMYYYY

Step 3 Type the following command to add an audit policy:

add audit syslogPolicy <PolicyName> <Rule> <ActionName>

Where:

<PolicyName> is a descriptive name for the syslog policy. <Rule> is the rule or expression the policy uses. The only supported value is

ns_true. <ActionName> is a descriptive name for the syslog server action.

For example:

add audit syslogPolicy policy-SIEM ns_true action-SIEM

Step 4 Type the following command to bind the policy globally:

bind system global <PolicyName> -priority <Integer>

Where:

<PolicyName> is a descriptive name for the syslog policy. <Integer> is a numeric value used to rank message priority for multiple policies

that are communicating using syslog.

Configuring DSMs

Page 88

72 CITRIX NETSCALER

NOTE

Step 5 Type the following command to save the Citrix NetScaler configuration.

Step 6 Type the following command to verify the po lic y is sa ved in your configuration:

Step 7 You are now ready to configure the log source in SIEM.

For example:

bind system global policy-SIEM -priority 30

When multiple policies have priority assigned to them as a numeric value the lower priority value is evaluated before the higher value.

save config

sh system global

For information on configuring syslog using the Citrix NetScaler user interface, see http://support.citrix.com/article/CTX121728 or your vendor documentation.

SIEM automatically detects the Citrix NetScaler device. If you want to manually configure SIEM to receive events from Citrix NetScaler:

From the Log Source Type drop-down list box, select the Citrix NetScaler

option.

For more information on configuring log sources, see the Log Sources User Guide.

Configuring DSMs

Page 89

NOTE

CRYPTOCARD CRYPTO-SHIELD

The SIEM CRYPTOCard CRYPTO-Shield DSM accepts events using syslog. SIEM records all relevant events. Before configuring a CRYPTOCard CRYPTO-Shield device in SIEM, you must configure your device to send syslog events to SIEM.

To configure the device to send syslog events to SIEM, you must:

Step 1 Configur e the following System Configuration parameters:

You must have CRYPTOCard Operator access with the assigned default Super-Operator system role to access the System Configuration parameters.

• log4j.appender.<protocol> - Directs the logs to a syslog host where the

<protocol> is the type of log appender, which determines where you want to

send logs for storage. The options are: ACC, DBG , or LOG. For this parameter, type the following:

org.apache.log4j.net.SyslogAppender

• log4j.appender.<protocol>.SyslogHost <IP address>

address or hostname of the syslog server where:

<protocol> is the type of log appender, which determines where you want

to send logs for storage. The options are: ACC, DBG, or LOG.

<IP address> is the IP address of the SIEM host to which you want to send

logs. This value can only be specified when the first parameter is configured.

This parameter can only be specified when the log4j.apender.<protocol> parameter is configured.

Step 2 You are now ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a CRYPTOCard CRYPTO-Shield device:

From the Log Source Type drop-down list box, select the CRYPTOCard

CRYPTOShield option. For more information on configuring log sources, see

the Log Sources User Guide.

For more information about your CRYPTOCard CRYPTO-Shield device, see your vendor documentation.

- Type the IP

Configuring DSMs

Page 90

Page 91

CYBER-ARK VAULT

The SIEM Cyber-Ark Vault DSM accepts events using the Log Enhanced Event Protocol (LEEF). SIEM records both user activities and safe activities from the Cyber-Ark Vault in the audit log events. Cyber-Ark Vault integrates with SIEM to forward audit logs using syslog to create a complete audit picture of privileged account activities in SIEM. Before configuring a Cyber-Ark Vault device in SIEM, you must configure your device to send events to SIEM.

To integrate the device with SIEM:

Step 1 Log in to the Cyber-Ark device. Step 2 Open the file DBParm.ini. Step 3 Configure the following parameters:

• SyslogServerIP - Type the IP address of SIEM.

• SyslogServerPort - Type the UDP port used to connect to SIEM. The default

value is 514.

• SyslogMessageCodeFilter - Configure which message codes are sent from

the Cyber-Ark Vault to SIEM. You can define specific message numbers or a range of numbers. By default, all message codes are sent for user activities and safe activities.

For example, to define a message code of 1,2,3,30 and 5-10, you must type:

1,2,3,5-10,30.

•

SyslogTranslatorFile - Type the file path to the LEEF.xsl translator file. The translator file is used to parse Cyber-Ark audit records data in the syslog protocol.

Step 4 Copy LEEF.xsl to the location specified by the SyslogTranslatorFile parameter in

the DBParm.ini file.

Step 5 You are now ready to configure the log source in SIEM.

To configure SIEM to receive events from a Cyber-Ark Vault device:

From the Log Source Type drop-down list box, select Cyber-Ark Vault from

the Log Source Type option. For more information on configuring log sources, see the Log Sources User Guide.

For more information on Cyber- Ark Vault, see your vendor documentation.

Configuring DSMs

Page 92

Page 93

CYBERGUARD FIREWALL/VPN A

PPLIANCE

A SIEM CyberGuard Firewall VPN Appliance DSM accepts CyberGuard events using syslog. SIEM records all relevant CyberGuard events. SIEM supports the CyberGuard KS series of appliances.

Before you configure SIEM to integrate with a CyberGuard device, you must:

Step 1 Log in to the CyberGuard user interface. Step 2 Select the Advanced page. Step 3 Under System Log, select Enable Remote Logging. Step 4 Type the IP address of SIEM. Step 5 Click Apply. Step 6 You are now ready to configure the log source in SIEM.

To configure SIEM to re ceive events from a CyberGuard Firewall VPN device:

From the Log Source Type drop-down list box, select the CyberGuard TSP

Firewall/VPN option.

For more information on configuring log sources, see the Log Sources User Guide. For more information on configuring your CyberGuard device, consult yo ur

CyberGuard documentation.

Configuring DSMs

Page 94

Page 95

EMC VMWARE

The SIEM EMC VMWare DSM accepts events from virtual environments using either the VMWare protocol or syslog. SIEM records all relevant events from the VMWare Web service.

Select one of the following configuration methods:

• Configuring Syslog for VMWare

• Configuring the VMWare Protocol

Configuring Syslog for VMWare

Step 1 Log in to your VMWare vSphere Client. Step 2 Select the host managing your VMWare inventory. Step 3 Click the Configuration tab. Step 4 From the Software panel, click Advanced Settings.

Step 5 On the left-hand navigation, click Syslog. Step 6 Configur e values for the following parameters:

The syslog configuration for VMWare allows you to forward events using syslogd from your ESXi 3.5 or 4.x server to SIEM.

To configure VMWare ESXi using syslog, perform the following steps:

The Advanced Settings window is displayed.

Table 19-2

Parameter Description

Syslog.Local.Datastor ePath

Syslog.Remote.Hostn ame

Syslog.Remote.Port Type the port number the ESXi server uses to forward syslog

Type the directory path for the local syslog messages on your ESXi server. The fault directory path is [] /scratch/log/messages.

Type the IP address or hostname of SIEM.

data. The default is port 514.

Step 7 Click OK to save the configuration.

Configuring DSMs

Page 96

You are now ready to configure the log source in SIEM.

CAUTION

SIEM automatically detects syslog events from your EMC VMWare server. However, if you want to manually configure SIEM to receive events from your VMWare ESX server:

From the Log Source Type drop-down list box, select EMC VMWare.

Configuring the VMWare Protocol

Creating an ESX

Account for SIEM

When configuring the EMC VMWare DSM to use the VMWare protocol, we recommend you create a user who is a member of the root group for SIEM, but provide the user with an assigned role of read-only permissions. This ensures that the VMWare virtual environment collects events using the VMWare protocol and maintains a level of security for the new SIEM user you are adding.

To integrate EMC VMWare with SIEM, you must:

1 Create an ESX account for SIEM. For more information, see Creating an ESX

Account for SIEM.

2 Configure account permissions for the SIEM user. For more information, see

Configuring Account Permissions.

3 Configure the VMWare protocol in SIEM. For more information, see Configuring

SIEM.

Creating a user who is not part of the root or an administrative group may lead to some events not being collected by SIEM. We recommend adding your SIEM user to an administrative group, but assign a read-only role.

To create a SIEM user account for EMC VMWare:

Step 1 Log in to your ESX host using the vSphere Client. Step 2 Click the Local Users & Groups tab. Step 3 Click Users.

A list of user accounts is displayed.

Step 4 Right-click and select Add.

The Add New User window is displayed.

Step 5 Configure the following parameters:

a Login - Type a login name for the new user. b UID - Optional. Type a user ID. c User Name - Optional. Type a user name for the account. d Password - Type a password for the account. e Confirm Password - Type the password again as confirmation. f Group - From the Group drop-down list box, select root.

Page 97

Configuring the VMWare Protocol 81

Step 6 Step 7 Click OK.

Configuring Account

Permissions

Step 1 Click the Permissions tab. Step 2 Right-click and select Add Permissions.

Step 3 On the Users and Groups window, click Add.

Step 4 Select your SIEM user and click Add. Step 5 Click OK.

Step 6 From the Assigned Role drop-down list box, select Read-only.

Click Add.

You are now ready to set the account permission for the user you created.

For security reasons, we recommend you configure your SIEM user account as a member of your root or admin group, but select an assigned role of read-only permissions. This allows the SIEM user account to view and collect events using the VMWare protocol, but prevents external changes to your ESX environment.

To configure read-only permissions:

The Assign Permissions window is displayed.

The Select Users and Groups window is displayed.

The Add Permissions window is displayed.

Step 7 Click OK.

You are now ready to configure SIEM to receive EMC VMWare events.

Configuring SIEM To configure SIEM to receive EMC VMWare events:

Step 1 Log in to SIEM. Step 2 Click the Admin tab. Step 3 On the navigation menu, click Data Sources.

The Data Sources panel is displayed.

Step 4 Click the Log Sources icon.

The Log Sources window is displayed.

Step 5 Click Add.

The Add a log source window is displayed.

Step 6 From the Log Source Type drop-down list box, select EMC VMWare. Step 7 Using the Protocol Configuration drop-down list box, select EMC VMWare.

The VMWare protocol configuration is displayed.

Step 8 Configure the following values:

Configuring DSMs

Page 98

82 EMC VMWARE

Step 10 On the Admin tab, click Deploy Changes.

Table 19-3 VMWare Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source. This

value must match the value configured in the ESX IP field. ESX IP Type the IP address of the VMWare server. User Name Type the username required to access the VMWare server. Password Type the password required to access the VMWare server.

Step 9 Click Save.

For more information on configuring the VMWare protocol, see the Log Sources User Guide.

For more information about your VMWare ESX server, see your vendor documentation.

Configuring DSMs

Page 99

ENTERASYS

This section provides information on the following DSMs:

• Enterasys Dragon

• Enterasys HiGuard Wireless IPS

• Enterasys HiPath Wireless Controller

• Enterasys Stackable and Standalone Switches

• Enterasys XSR Security Router

• Enterasys Matrix Router

• Enterasys NetSight Automatic Security Manager

• Enterasys Matrix K/N/S Series Switch

• Enterasys NAC

Enterasys Dragon A SIEM Enterasys Dragon DSM accepts Enterasys events using either syslog or

SNMPv3. SIEM records all relevant Enterasys Dragon events. Before you configure SIEM to integrate with Enterasys Dragon, you must create an Alarm Tool policy using either an SNMPv3 or Syslog notification rule.

To configure your SIEM En terasys Dragon DSM, you must:

1 Choose one of the following:

a Create an Alarm Tool policy using an SNMPv3 notification rule. See Creating an

Alarm Tool Policy Using an SNMPv3 Notification Rule.

b Create an Alarm Tool policy using a Syslog notification rule. See Creating a

Policy with a Syslog Notification Rule.

2 Configure the log source within SIEM. See Configuring SIEM. 3 Configure Dragon Enterprise Management Server (EMS) to forward syslog

messages. See Configuring the EMS to Forward Syslog Messages to SIEM

Creating an Alarm Tool Policy Using an SNMPv3 Notification

Rule

This procedure describes how to configure an Alarm T ool policy using an SNMPv3 notification rule. Use SNMPv3 notification rules if you need to transfer PDATA binary data elements.

Configuring DSMs

Page 100

84 ENTERASYS

NOTE

To configure Enterasys Dragon with an Alarm Tool policy using an SNMPv3 notification rule:

Step 1 Log in to the Enterasys Dragon EMS. Step 2 Click the Alarm Tool icon. Step 3 Configur e the Alarm Tool Policy:

a In the Alarm Tool Policy View > Custom Policies menu tree, right-click and

select Add Alarm Tool Policy. The Add Alarm Tool Policy window is displayed.

b In the Add Alarm Tool Policy field, type a policy name.

For example:

Enterasys Networks

c Click OK. d In the menu tree, select the policy name you entered from Step b.

Step 4 To configure the event group:

a Click the Events Group tab. b Click New.

The Event Group Editor is displayed.

c Select the event group or individual events to monitor. d Click Add.

A prompt is displayed.

e Click Yes. f In the right column of the Event Group Editor, type Dragon-Events. g Click OK.

Step 5 Configure the SNMPv3 notification rules:

a Click the Notification Rules tab. b Click New. c In the name field, type Enterasys Networks-Rule. d Click OK. e In the Notification Rules panel, select Enterasys Networks-Rule. f Click the SNMP V3 tab. g Click New. h Update SNMP V3 values, as required:

- Server IP Address - Type the SIEM server IP address.

Do not change the OID.

Configuring DSMs