Hi, Mick.
Here is my scheme:
1. I have a Debian with snmptrapd. Snmptrapd is daemon that receives
traps and writes them into file, syslog - by default, but in its config
you can specify file you need. On this machine also there is SEC.pl
(http://kodu.neti.ee/~risto/sec/) which I use for programmable event
correlation and reporting.
2. In sensors policy I checked SNMP trap response for desired
signatures, so that in case of these events SNMP trap is sent to my
snmptrapd.
Is this what you're need?
Also you can use SP central reporting feature to send SNMP traps
somewhere.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 495 745 89 50
tel +7 495 777 77 07 (1613)
-----Original Message-----
From: issforum-bounces@iss.net
[mailto:issforum-bounces@iss.net] On Behalf Of Mick Ryan
Sent: Friday, November 18, 2005 5:14 PM
To: issforum@iss.net
Subject: [ISSForum] How to send event data to a syslog server?
Does anyone know how to send events to a syslog server from
Site Protector? I've got a number of Proventia G series
sensors and Server Sensors deployed that all feed back to my
Event collector, how can I get all that data sent to a syslog
server so it can be used by Lancope StealthWatch and
Checkpoint Eventia Analyzer?
Basically I don't want to use the Fusion module anymore and
want all my IDS events sent to another event correlation engine.
Thanks in advance for all help.
Mick Ryan
Networks & Information Security
Corrections Corporation of America
(W): 615-263-3217
(F): 615-263-3239
mick.ryan@correctionscorp.com
-----------------------------------------
(i) This e-mail and any files transmitted with it are confidential and
intended solely for the use of the intended recipient(s). If you have
received this e-mail in error, please notify the sender
immediately and
delete this e-mail and any associated files from your system. (ii)
Views or opinions presented in this e-mail are solely those of the
author and do not necessarily represent those of Corrections
Corporation of America. (iii) The recipient should check this e-mail
and any attachments for the presence of viruses. The company
accepts no
liability for errors or omissions caused by e-mail transmission or any
damage caused by any virus transmitted by or with this e-mail. This
email has been scanned for content and viruses by the
CipherTrust Email
Security System.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet
Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
