XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 2. Sending Data to Your ArcSight SIEM
XYPRO Technology Corporation 29 Proprietary and Confidential
2.4.1 Testing Your SIEM connection
Use the XMA_MANAGER to test your HP NonStop-to-SIEM connection. (Refer to
chapter Chapter 5, “Using XMA_MANAGER.”)
1. Logon as the XMA owner in order to run XMA_MANAGER.
2. Load the XMA TACL segment, start the XMA_MANAGER and select
option 2: Movers.
3. To use the IPALERT message, select option 16: Test basic Alerts in the Movers
Management Menu. (Refer to section 5.4 starting on page 101.)
4. When prompted for an alert type, select T for TCP/IP Syslog.
Please enter the alert type <(M)ail, (S)NMP Trap, (U)DP Syslog, (T)CP/IP
Syslog, or (C)ollector> ->t
You will see the following prompts:
To modify any of the items below choose an option
otherwise select R to continue :
1: DNS name or IP Address :127.0.0.1
2: Port :514
3: Node :\PROD
4: IP Process :$ZTC0
X: Exit from this menu
R: Run
To clear the value for options that can be cleared, please enter '*'
Selection ?
5.
Select option 1: DNS name or IP Address and enter the IP address of your SIEM
device.
Selection ?1
Please enter the DNS name or IP address you want to send the alert to
<127.0.0.1> ?
6.
Verify that the IP Process name is correct. When you are ready to run the test,
select R: RUN.
Selection ?r
\PROD.$sec.xygatema.ipalert T 2013-10-08 16:05:42 $ZTC0 10.1.1.12:514 <130>
Beginning
Finished
Command completed successfully
Press Return to continue ...
The test message should have been received by the ArcSight appliance. The message
will appear in the same place as the categorized records, but things will not be in the
correct columns. View the records on the ArcSight by selecting the source system.