McAfee Enterprise Security Manager. Data Source Configuration Guide. Infoblox NIOS. Data Source: September 2, Infoblox NIOS Page 1 of 8

Transcription

1 McAfee Enterprise Security Manager Data Surce Cnfiguratin Guide Data Surce: Infblx NIOS September 2, 2014 Infblx NIOS Page 1 f 8

2 Imprtant Nte: The infrmatin cntained in this dcument is cnfidential and prprietary. Please d nt redistribute withut permissin. Infblx NIOS Page 2 f 8

3 Table f Cntents 1 Intrductin 4 2 Prerequisites 4 3 Specific Data Surce Cnfiguratin Details Infblx NIOS Cnfiguratin 5 Cnfiguring Syslg fr a Grid Member McAfee Receiver Cnfiguratin 7 4 Appendix A - Generic Syslg Cnfiguratin Details 8 5 Appendix B - Trubleshting 8 Infblx NIOS Page 3 f 8

4 1 Intrductin This guide details hw t cnfigure Infblx NIOS t send syslg data in the prper frmat t the ESM. 2 Prerequisites McAfee Enterprise Security Manager Versin and abve. In rder t cnfigure the Infblx NIOS syslg service, apprpriate administrative level access is required t perfrm the necessary changes dcumented belw. Infblx NIOS Page 4 f 8

5 3 Specific Data Surce Cnfiguratin Details 3.1 Infblx NIOS Cnfiguratin 1. Frm the Grid perspective, click grid ->Edit -> Grid Prperties Or Frm the Device perspective, click hstname -> Edit -> Device Prperties 2. In Grid r Device editr, click Mnitring, and then enter the fllwing: - Enable external syslg server: Select this check bx t enable the Infblx device t send messages t the specified syslg server. - Syslg Server Grup: Define ne r mre syslg servers: click Add, enter the fllwing, then click OK: Server Address: Enter the IP address f the syslg server. Cnnectin Type: Specify whether the device uses TCP r UDP t cnnect t the external syslg server. Prt: Specify the destinatin prt number. (Standard prt is 514) Out Interface: Specify the interface thrugh which the device sends syslg messages t the syslg server. Severity Filter: Chse a filter frm the drp-dwn list. Message Surce: Specify which syslg messages the device sends t the external syslg server:! Internal: Device sends the syslg messages that it generates.! External: Device sends the syslg messages that it receives frm ther devices, such as syslg servers and ruters.! Any: Device sends bth internal and external syslg messages. Cpy audit lg messages t syslg: Select the check bx fr the Infblx device t include audit lg messages amng the messages it sends t the syslg server. This functin can be helpful fr mnitring administrative activity n multiple devices frm a central lcatin. Audit Lg Facility: Chse the facility where yu want the syslg server t srt the audit lg messages. 3. Click the Save icn t save yur settings. Cnfiguring Syslg fr a Grid Member 1. Frm the Grid perspective, click + (fr grid) -> + (fr Members) -> member -> Edit -> Member Prperties. 2. In the Grid Member editr, click Mnitring, and enter the fllwing: Override grid syslg settings: Select the check bx t verride grid-level syslg settings and apply member-level settings. Enable external syslg server: Select the check bx t enable the Infblx device t send messages t a specified syslg server. Syslg Server Grup: T define ne r mre syslg servers, click Add, enter the fllwing, and then click OK:! Server Address: Type the IP address f a syslg server.! Cnnectin Type: Specify whether the device uses TCP r UDP t cnnect t the external syslg-server.! Prt: Specify the destinatin prt number. Infblx NIOS Page 5 f 8

6 ! Out Interface: Specify the interface thrugh which the device sends syslg messages t the syslg server.! Severity Filter: Chse a filter frm the drp-dwn list. Message Surce: Specify which syslg messages the device sends t the external syslg server:! Internal: The device sends the syslg messages that it generates.! External: The device sends the syslg messages that it receives frm ther devices! Any: The device sends bth internal and external syslg messages. - Enable syslg prxy: Select this check bx t enable the device t receive syslg messages frm ther devices, such as syslg servers and ruters, and then frward these messages t an external syslg server. - Enable listening n TCP: Select this check bx if the device uses TCP t receive messages frm ther devices. Prt: Enter the prt number thrugh which the device receives syslg messages frm ther devices. - Prxy Client Access Cntrl: Click Add, enter the fllwing in the Access Cntrl Item dialg bx, and then click OK: IP Address ptin: Select IP Address if yu are adding the IP address f a device, r select Netwrk if yu are adding the netwrk address f a grup f devices.! Address: Enter the IP address f the device r netwrk.! Subnet Mask: If yu entered a netwrk IP address, yu must als enter its subnet mask. 3. Click the Save icn t save yur settings. Infblx NIOS Page 6 f 8

7 3.2 McAfee Receiver Cnfiguratin After successfully lgging int the McAfee ESM cnsle the data surce will need t be added t a McAfee Receiver in the ESM hierarchy. 1. Select the Receiver yu are applying the data surce setting t. 2. Select the Receiver prperties. 3. Frm the Receiver Prperties listing, select Data Surces. 4. Select Add Data Surce. OR 1. Select the Receiver yu are applying the data surce setting t. 2. After selecting the Receiver, select the Add Data Surce icn. Data Surce Screen Settings 1. Data Surce Vendr Infblx 2. Data Surce Mdel NIOS (ASP) 3. Data Frmat Default 4. Data Retrieval Default 5. Enabled: Parsing/Lgging/SNMP Trap Parsing 6. Name Name f data surce 7. IP Address/Hstname The IP address and hst name assciated with the data surce device. 8. Syslg Relay Nne 9. Mask Require Syslg TLS Enable t require the Receiver t cmmunicate ver TLS. 11. Supprt Generic Syslgs D nthing 12. Time Zne Time zne f data being sent. Nte Refer t Appendix A fr details n the Data Surce Screen ptins Infblx NIOS Page 7 f 8

8 4 Appendix A - Generic Syslg Cnfiguratin Details Once yu select the ptin t add a data surce, yu are taken t the Add Data Surce menu. The general ptins fr adding a data surce are shwn. As yu select different ptins, additinal parameters may shw. Each f these parameters will be examined in mre detail. 1. Use System Prfiles System Prfiles are a way t use settings that are repetitive in nature, withut having t enter the infrmatin each time. An example is WMI credentials, which are necessary t retrieve Windws Event Lgs if WMI is the chsen mechanism. 2. Data Surce Vendr List f all supprted vendrs. 3. Data Surce Mdel List f supprted prducts fr a vendr. 4. Data Frmat Data Frmat is the frmat the data is in. Optins are Default, CEF, and MEF. Nte If yu chse CEF it will enable the generic rule fr CEF and may nt parse data surce-specific details. 5. Data Retrieval Data Retrieval allws yu t select hw the Receiver is ging t cllect the data. Default is ver syslg. 6. Enabled: Parsing/Lgging/SNMP Trap Enables parsing f the data surce, lgging f the data surce, and receptin f SNMP traps frm the data surce. If n ptin is checked, the settings are saved t the ESM, but nt written t the Receiver r utilized. Default is t select Parsing. 7. Name This is the name that will appear in the Lgical Device Grupings tree and the filter lists. 8. IP Address/Hstname The IP address and hst name assciated with the data surce device. 9. Syslg Relay Syslg Relay allws data t be cllected via relays and bucketed t the crrect data surce. Enable syslg relay n relay surces such as Syslg-NG. 10. Mask Enables yu t apply a mask t an IP address s that a range f IP addresses can be accepted. 11. Require Syslg TLS Enable t require the receiver t cmmunicate ver TLS. 12. Supprt Generic Syslg Generic Syslg allws users t select Parse generic syslg r Lg unknwn syslg event. Bth these ptins will create an alert fr an aut-learned syslg event if there is n parsing rule. 13. Time Zne - If syslg events are sent in a time zne ther than GMT, yu need t set the time zne f the data surce s the date n the events can be set accrdingly. 14. Interface Opens the receiver interface settings t assciate prts with streams f infrmatin. 15. Advanced Opens advanced settings fr the data surce. 5 Appendix B - Trubleshting If a data surce is nt receiving events, verify that the data surce settings have been written ut and that plicy has been rlled ut t the Receiver. If yu see errrs saying events are being discarded because the Last Time value is mre than ne hur in the future, r the values are incrrect, yu may need t adjust the Time Zne setting. Infblx NIOS Page 8 f 8