Powered by Zoomin Software. For more details please contactZoomin

Web Application Firewall User Guide

Filters

Clear All Filters
Source Type
Application Security
Data Security
Network Security
Application Performance
Product Versions
Hypervisor Installation
Document Type
Access
Product Area
Clear All Filters
This guide

Configuring Integration with ArcSight

Save PDF
Save selected topicSave selected topic and subtopicsSave all topics
Share
Share to emailCopy topic URL
Feedback
Print
Table of Contents
HomeWeb Application Firewall User Guide...Advanced SecureSphere ConfigurationConfiguring Integration with Third Party Management SystemsConfiguring Integration with ArcSightCurrent page
Table of Contents

Configuring Integration with ArcSight

 Configuring Integration with ArcSight

This procedure describes how to configure SecureSphere integration with ArcSight, enabling the reporting of SecureSphere events to ArcSight where events can be correlated and processed.

Configuring integration with Arcsight involves the tasks listed in the following table.

Configuring Integration with Arcsight – Task Overview

 

Action

Description

For more information, see...

1

Create action set.

Create an action set to be assigned as a followed action, which generates a task.

Creating Custom Action Sets.

2

Configure Action Interfaces.

Add Review or Assignment action interfaces to the action set and configure its parameters.

Configuring Action Interface Parameters.

3

Configure Policy with Followed Actions.

Attach the ArcSight action set to a policy as a followed action.

Assigning Followed Actions.

To configure integration with ArcSight:

  1. Create a new System Event Type Action Set with an intuitive name. For example, ArcSightSyslogEvent as described in Creating Custom Action Sets.
  2. In the Main workspace, select Policies > Action Sets. The Action Sets window appears.
  3. Select the new Action Set created in step 1 above. Available action interfaces are listed in the Action Interface pane.
  4. Add the desired action interface to the Selected Actions pane by clicking on its green arrow. Note there are four event types for CEF Standard:
    • Regular Security Event (System Log > Log security event to System Log (syslog) using the CEF standard): Logs a regular security event to System Log (syslog) using the CEF standard.
    • Custom Event (System Log > Custom Policy Security Event): Logs a custom event to System Log (syslog) using the CEF standard.
    • Firewall Security Event (System Log > Firewall Security Event): Logs firewall event to System Log (syslog) using the CEF standard.
    • System Event (System Log > Log system event to System Log (syslog) using the CEF standard): Logs a system event to System Log (syslog) using the CEF standard.
  5. Expand the selected CEF System Log action interface by clicking on the plus sign (+) to its right.
  6. Configure it as follows:
    • Name: Type a name for the Syslog event.
    • Syslog Host: Type the IP or host name of the ArcSight server.
    • Syslog Log level: Select the desired syslog log level from the dropdown list (info, warn, debug or error).
    • Message: Type a message with placeholder information to be used by syslog to create a message readable by ArcSight. This message must follow CEF guidelines. For a description of the CEF syslog message, including syntax and available placeholders, see ArcSight Placeholders and Syntax.

      Note: The message field may be locked by your SecureSphere administrator. In this case the message is predefined and can only be modified by the administrator.
    • Facility: Select the required facility (type of authorization required by your installation of Arcsight).
    • Run on every event: Select this checkbox if you want to send a syslog event to Arcsight for every event.
  7. In the Policies > Security window, select the action set created in step 1 from the followed action dropdown list of the policy you want to configure.
  8. Click Save. Settings are saved. If you are in delayed activation mode, you need to activate these settings. For more information, see Activating Settings.

    When a violation occurs, an alert is generated and a syslog message is sent to ArcSight.

Was this topic helpful?
LikeDislike