RSA Event Source Configuration Guide Infoblox NIOS Last Modified: Tuesday, March 11, 2014 Event Source (Device) Product Information Infoblox Vendor Event Source (Device) Supported Versions Supported Platforms NIOS 5.1, 6.4.5 Linux RSA Product Information Supported Version Event Source (Device) Type Collection Method Event Source (Device) Class.Subclass Content 2.0 Table RSA enVision 4.0 and 4.1 Security Analytics 10.0 and later infobloxnios, 226 Syslog Network.System Network This document contains the following information for the Infoblox NIOS event source: l Configuration Instructions l Release Notes 20140311-145050 l Release Notes 20130228-133928 l Release Notes 20120927-104626 l Release Notes 20120829-110505 l Release Notes 20120529-140644 l Release Notes 20120328-170659 Infoblox NIOS Configuration Instructions To configure Infoblox NIOS to work with the RSA enVision appliance, do the following: l Configure Infoblox NIOS to send syslog messages to the RSA enVision appliance l (Optional) View syslog messages in the Infoblox console Copyright © 2012 EMC Corporation. All Rights Reserved. RSA Event Source Configure Infoblox NIOS to send syslog messages to the RSA enVision appliance To configure Infoblox NIOS: 1. Log on to the Infoblox console with your administrative credentials. 2. Click Grid > Grid Manager > Members. 3. From the Toolbar, click Grid Properties > Edit. 4. In the Grid Properties Editor window, on the Monitoring tab, in the Syslog section, do the following: a. In the Syslog Size(MB) field, enter a value between 10 and 300 for the maximum syslog file size. The default setting is 300. b. Select Log to External Syslog Servers. c. Click the Add button and in the External Syslog Servers section, in the new row, enter the following information. Column Action Address Transport Interface Source Port Severity Enter the IP address of yourenVision appliance. Select UDP. Select Any. Select Internal. Enter 514. This is the default value. Select notice. d. Select Copy Audit Log Message to Syslog. e. From the Syslog Facility menu, select daemon. f. Click Save & Close. 2 Configure Infoblox NIOS to send syslog messages to the RSA enVision appliance RSA Event Source (Optional) View syslog messages in the Infoblox console To view messages in the Infoblox console: 1. Log on to the Infoblox console with your administrative credentials. 2. Click Administration > Logs > Syslog. 3. From the Member menu, select the grid member that you want to view. 4. Click Show Filters and edit the filter categories as needed. 5. Click Apply. Infoblox NIOS Release Notes (20140311-145050) New and Updated Event Messages in Infoblox NIOS For complete details on new and updated messages, see the Event Source Update Help. Infoblox NIOS Release Notes (20130228-133928) New and Updated Event Messages in Infoblox NIOS For complete details on new and updated messages, see the Event Source Update Help. Infoblox NIOS Release Notes (20120927-104626) What's New in This Release RSA has verified support for Infoblox NIOS version 6.4.5 for use with the RSA enVision platform. Infoblox NIOS Release Notes (20120829-110505) New and Updated Event Messages in Infoblox NIOS For complete details on new and updated messages, see the Event Source Update Help. Infoblox NIOS Release Notes (20120529-140644) New and Updated Event Messages in Infoblox NIOS For complete details on new and updated messages, see the Event Source Update Help. Infoblox NIOS Release Notes (20120328-170659) (Optional) View syslog messages in the Infoblox console 3 RSA Event Source New and Updated Event Messages in Infoblox NIOS For complete details on new and updated messages, see the Event Source Update Help. 4 (Optional) View syslog messages in the Infoblox console