User`s guide

Technical white paper
22
HP TippingPoint Security Management System (SMS) Appliance
The TippingPoint product has two types of devices, sensors and SMS devices, that act as the management console and
central logging point. The SMS provides a separate syslog output format option that works with third-party network security
devices and host applications. ArcSight currently supports only events sent to the Connector from the SMS console, not the
events sent directly to the Connector from the sensor devices, as the two devices log in slightly different formats.
To enable the HP TippingPoint Security Management System (SMS) Appliance to be monitored and viewed in HP ArcSight
ESM, you need to point the internal system log of the SMS to the HP ArcSight ESM. The HP ArcSight Connector cannot be
installed directly on the SMS system, another system (Linux or Windows) will need to be leveraged to point the SMS to, and
that system will require the Connector to be installed to talk to the HP ArcSight ESM or HP ArcSight Logger. To complete this
action, perform the following steps:
• With the HP ArcSight Connector for Windows, you are able to monitor TippingPoint SMS syslog information. You will first
need to install the HP ArcSight Connector as described in the ArcSight documentation – User’s Guide HP ArcSight
SmartConnectors. Once you are at the “Select the connector to configure” window select “TippingPoint SMS Syslog
Extended” (Figure 22). Select “Next >”
Figure 22. Selecting the “TippingPoint SMS Syslog Extended” Connector
• On the “Enter the connector details” window, fill in the appropriate information for your environment. You do not need to
specify a username and password. Select “Next >”