RSA Event Source Configuration Guide
Infoblox NIOS
Last Modified: Tuesday, March 11, 2014
Event Source (Device) Product Information
Infoblox
Vendor
Event Source (Device)
Supported Versions
Supported Platforms
NIOS
5.1, 6.4.5
Linux
RSA Product Information
Supported Version
Event Source (Device) Type
Collection Method
Event Source (Device) Class.Subclass
Content 2.0 Table
RSA enVision 4.0 and 4.1
Security Analytics 10.0 and later
infobloxnios, 226
Syslog
Network.System
Network
This document contains the following information for the Infoblox NIOS event source:
l
Configuration Instructions
l
Release Notes 20140311-145050
l
Release Notes 20130228-133928
l
Release Notes 20120927-104626
l
Release Notes 20120829-110505
l
Release Notes 20120529-140644
l
Release Notes 20120328-170659
Infoblox NIOS Configuration Instructions
To configure Infoblox NIOS to work with the RSA enVision appliance, do the following:
l
Configure Infoblox NIOS to send syslog messages to the RSA enVision appliance
l
(Optional) View syslog messages in the Infoblox console
Copyright © 2012 EMC Corporation. All Rights Reserved.
RSA Event Source
Configure Infoblox NIOS to send syslog messages to
the RSA enVision appliance
To configure Infoblox NIOS:
1. Log on to the Infoblox console with your administrative credentials.
2. Click Grid > Grid Manager > Members.
3. From the Toolbar, click Grid Properties > Edit.
4. In the Grid Properties Editor window, on the Monitoring tab, in the Syslog section, do the
following:
a. In the Syslog Size(MB) field, enter a value between 10 and 300 for the maximum syslog file
size. The default setting is 300.
b. Select Log to External Syslog Servers.
c. Click the Add button and in the External Syslog Servers section, in the new row, enter the
following information.
Column
Action
Address
Transport
Interface
Source
Port
Severity
Enter the IP address of yourenVision appliance.
Select UDP.
Select Any.
Select Internal.
Enter 514. This is the default value.
Select notice.
d. Select Copy Audit Log Message to Syslog.
e. From the Syslog Facility menu, select daemon.
f. Click Save & Close.
2
Configure Infoblox NIOS to send syslog messages to the RSA enVision appliance
RSA Event Source
(Optional) View syslog messages in the Infoblox
console
To view messages in the Infoblox console:
1. Log on to the Infoblox console with your administrative credentials.
2. Click Administration > Logs > Syslog.
3. From the Member menu, select the grid member that you want to view.
4. Click Show Filters and edit the filter categories as needed.
5. Click Apply.
Infoblox NIOS Release Notes (20140311-145050)
New and Updated Event Messages in Infoblox NIOS
For complete details on new and updated messages, see the Event Source Update Help.
Infoblox NIOS Release Notes (20130228-133928)
New and Updated Event Messages in Infoblox NIOS
For complete details on new and updated messages, see the Event Source Update Help.
Infoblox NIOS Release Notes (20120927-104626)
What's New in This Release
RSA has verified support for Infoblox NIOS version 6.4.5 for use with the RSA enVision platform.
Infoblox NIOS Release Notes (20120829-110505)
New and Updated Event Messages in Infoblox NIOS
For complete details on new and updated messages, see the Event Source Update Help.
Infoblox NIOS Release Notes (20120529-140644)
New and Updated Event Messages in Infoblox NIOS
For complete details on new and updated messages, see the Event Source Update Help.
Infoblox NIOS Release Notes (20120328-170659)
(Optional) View syslog messages in the Infoblox console
3
RSA Event Source
New and Updated Event Messages in Infoblox NIOS
For complete details on new and updated messages, see the Event Source Update Help.
4
(Optional) View syslog messages in the Infoblox console