RSA Event Source Configuration Guide. RSA Data Loss Prevention Suite

Transcription

1 Configuration Guide RSA Data Loss Prevention Suite Last Modified: Wednesday, October 02, 2013 Event Source (Device) Product Information Vendor RSA, The Security Division of EMC Event Source (Device) Data Loss Prevention Supported Versions 7.0.0, 8.0, 8.0 SP1, 8.5, 8.8, 9.0, 9.5, and 9.6 SP1 RSA Product Information Supported Version RSA envision 4.0 and 4.1 Security Analytics 10.0 and later Event Source (Device) Type rsadlp, 130 Collection method Syslog Event Source (Device) Class.Subclass Security.DLP Content 2.0 Table DLP This document contains the following information for the RSA Data Loss Prevention (DLP) Suite event source: Configuration Instructions Release Notes Release Notes Release Notes RSA Data Loss Prevention Suite Configuration Instructions Configure Syslog Output on RSA Data Loss Prevention Suite 8.x, 9.0, 9.5, and 9.6 SP1: To configure Syslog output on RSA Data Loss Prevention Suite 8.x, 9.0, 9.5, and 9.6 SP1 you must complete these tasks: I. Configure RSA DLP to send DLP incidents to the RSA envision appliance II. Configure RSA DLP to send System Alerts to the RSA envision appliance To configure RSA DLP to send DLP incidents to the RSA envision appliance: 2. Select Settings > SIEM Configuration. 3. Click New. 4. In the Syslog Host/IP field, enter the IP address for the RSA envision appliance. 5. Click Save. Copyright 2012 EMC Corporation. All Rights Reserved.

2 To configure RSA DLP to send System Alerts logging to the RSA envision appliance: 2. Select Settings > System Alerts Configuration. 3. Click New or Edit to update the configuration. 4. Select Syslog for Enterprise Manager, Network, and Datacenter. 5. Click Save. 2 RSA Data Loss Prevention Suite

3 DLP Table For RSA DLP 8.0 SP1, RSA has added several columns and variables to the DLP table. These new columns are described in the following table. Field Description Values Severity RiskFactor Denotes the severity of the DLP event. Numeric representation of risk, determined by the policy that was violated. CRITICAL HIGH MEDIUM LOW IGNORE Scale of 1 100, 100 being the highest risk. Number of (content) matches found for the MatchCount Positive integer primary policy that was violated. envision Mapping Column: Severity Variable: <severity> Column: Risk Variable: <risk_ num> Column: Counter1 Variable: <dclass_ counter1> For complete details on the DLP table, see the DLP table in the Help. Configure Syslog Output on RSA DLP To configure Syslog output on RSA Data Loss Prevention Suite 7.0, you must complete these tasks: I. Configure RSA DLP to send DLP incidents to your RSA envision appliance II. Change the default multi-value field delimiters in the DLP Enterprise Manager Note: RSA recommends that an RSA Professional Services Engineer perform this procedure. DLP Table 3

4 To configure RSA DLP to send DLP incidents to your RSA envision appliance: 2. Select Settings > SIEM Configuration. 3. Click New. 4. In the Syslog Host/IP field, enter the appropriate values. 5. In the Syslog Port field, enter the IP address for the RSA envision appliance server. 6. Click Save. Additionally, for the envision appliance to recognize the RSA DLP data, you need to change the default multi-value field delimiters in the DLP Enterprise Manager. RSA recommends that a qualified RSA Professional Services Engineer perform this procedure. To change the default multi-value field delimiters (for the envision appliance) in the DLP Enterprise Manager: Important: RSA recommends that an RSA Professional Services Engineer perform these steps. 1. Under the DLP Enterprise Manager (version 7.0 or later, GA only) installation, go to the webapps\root\web-inf\classes directory. 2. Edit the siem.properties file. 3. Set the value of the envision appliancemultivaluefielddelimiter to the caret character: ENVISION.multiValueFieldDelimiter="^" 4. Click Save, and Click Exit. 5. Restart the Enterprise Manager service. 4 DLP Table

5 Data Loss Prevention Suite Release Notes ( ) What's New in This Release RSA has qualified support for RSA Data Loss Prevention Suite version 9.6 SP1. New and Updated Event Messages in RSA DLP For complete details on new and updated messages, see the Event Source Update Help. Data Loss Prevention Suite Release Notes ( ) New and Updated Event Messages in RSA DLP For complete details on new and updated messages, see the Event Source Update Help. Data Loss Prevention Suite Release Notes ( ) What's New in This Release RSA has qualified support for RSA Data Loss Prevention Suite version 9.5. DLP Table 5