Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Configuring the SMS server to send logs to the ArcSight Connector.

    • Updated:
    • 28 Jul 2017
    • Product/Version:
    • TippingPoint SMS All
    • TippingPoint Virtual SMS
    • Platform:
Summary
This article shows the steps required to configure a remote SYSLOG server on the SMS and send the logs to an ArcSight Connector
Details
Public

Note: Designating a remote system log (SYSLOG) server does not automatically send notifications to that server. You must select the Remote System Log contact for action sets. After you apply these changes, active filters associated with the modified action set will send remote messages to the designated server.

Procedure:

  1.  Log in to the SMS from a client.
  2.  On the SMS Tool bar select the Admin icon.

User-added image

  1.  On the SMS navigation pane select the Server Properties page

User-added image

  1. On the Server Properties page select the Syslog tab

User-added image

The top section of the Syslog panel has a list of the pre-defined Syslog formats available. These formats are not user configurable. If a custom format is required, you can copy one of the pre-configured formats and edit the same. The bottom section of the Syslog panel displays the remote Syslog server configured if any.

  1.  On the bottom section of the Syslog panel click the New button. The Create Remote Syslog Notification Settings dialog box displays.

User-added image

  1.  In the Syslog Server box enter the IP address remote collector
  2.  Click on Log Type and from the dropdown box select the ArcSight CEF Format v4.2 entry.
  3.  Click on Facility and from the dropdown box select the Security/Authorization entry.

This option will send IPS events to the remote Syslog server. If you need to send SMS audit events then you would create a separate Remote Syslog Notification Setting for that using the Facility of Log Audit. The System Daemons facility relates to SMS Daemons and is used to capture the health event of the SMS.

  1.  Click OK when completed.

For customers on SMS v4.1 and earlier:

SMS syslog format "ArcSight CEF" found in SMS 4.1 and earlier, has swapped or missing fields. As such the ArcSight connector, does not receive the expected data.

Work around: In order to correct this issue the ArcSight CEF Format configuration on the SMS needs to be manually modified by adding a "dvchost" entry and modifying the value for the "cs5" field.

Procedure:

  1.  From the SMS client software navigate to Admin → Server Properties → Syslog.
  2.  From the Syslog Formats section select the appropriate Syslog entry (ArcSight CEF Format).
  3.  Press "Copy" to copy the desired Syslog format. The "Edit" Syslog Format screen displays.
  4.  Name the new Syslog format.
  5.  In the "Pattern" window, find the entry "cs5=${deviceName}" and change the entry to "cs5=SMS Name" where "SMS Name" is the simple DNS host name (not FQDN) of the SMS server sending the data to the ArcSight connector.
  6.  In the "Pattern" window, find the entry "cs5Label=Device Name" and change the entry to "cs5Label=SMS Name".
  7.  While still in the "Pattern" window, add the entry "dvhost=${deviceName}" to the new format.
  8.  In the Remote Syslog for Events section, create a new Syslog server, select the newly created Syslog format and point it to the ArcSight Connector
Premium
Internal
Rating:
Category:
Configure; Troubleshoot; Deploy
Solution Id:
TP000085503
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.