Integration Guide. NetIQ Sentinel Enterprise

Transcription

1 Integration Guide NetIQ Sentinel Enterprise Revised: 12 March 2018

2 About This Guide Guide Type Documented Integration WatchGuard or a Technology Partner has provided documentation demonstrating integration Guide Details WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product. NetIQ Sentinel Enterprise Integration Guide 2

3 NetIQ Sentinel Enterprise Integration Overview This document describes how to configure a WatchGuard Firebox or WatchGuard XTM to send log data to Sentinel Enterprise and monitor events using Sentinel Enterprise. Test Topology Platform and Software The hardware and software used to complete the steps outlined in this document include: Firebox device installed with Fireware Version: NetIQ Sentinel Enterprise Version: Sentinel Plugin of WatchGuard Firewalls Version: r1 Java 8 Configuration To complete this integration, you must have: WatchGuard Firebox NetIQ Sentinel Enterprise Sentinel Plugin of WatchGuard Firewalls NetIQ Sentinel Enterprise Integration Guide 3

4 Configure NetIQ Sentinel Enterprise To Configure NetIQ Sentinel Enterprise: 1. Log in to Sentinel Web Console interface at 2. Click Collection. 3. Click Event Source Servers. NetIQ Sentinel Enterprise Integration Guide 4

5 4. Confirm that Syslog Servers is running, that Syslog Server UDP port is available, and that the port number is 1514 (default setting). 5. Click Collection. 6. Click Advanced. 7. Click Launch Control Center. NetIQ Sentinel Enterprise Integration Guide 5

6 The Sentinel Control Center appears. 8. Select Event Source Management > Live View. The Event Source Management Center appears. 9. Select Tools > Import plug-in. NetIQ Sentinel Enterprise Integration Guide 6

7 The Import Plug-in Wizard appears. 10. Click Next to complete the plug-in import. 11. The WatchGuard Firewalls plug-in is listed in the Collectors and Event Source Palette. NetIQ Sentinel Enterprise Integration Guide 7

8 Configure Firebox to Send Syslog Messages to Sentinel Server 1. Log in to the Firebox Web UI at address of Firebox>: Select System > Logging. 3. Click the Syslog Server tab. 4. Select the Send log messages to the syslog server at this IP address check box. 5. In the IP Address text box, type the Sentinel Enterprise IP address. In our example, that IP address is In the Port text box, type the port configured in Sentinel to receive syslog sourced messages. 7. From the Log Format drop-down list, select Syslog. NetIQ Sentinel Enterprise Integration Guide 8

9 8. Other settings are optional. In this example we enabled the time stamp and the serial number of the device. 9. Click Save. NetIQ Sentinel Enterprise Integration Guide 9

10 Configure Java 8 Java 8 must be installed and for the Sentinel Web Console interface. Test the Integration 1. Log in to the Sentinel Web Console interface at 2. Click Collection. 3. Click Overview to display events. 4. Click Event Sources. 5. Click Advanced. 6. Click Launch Control Center. 7. Select Event Source Management > Live View. NetIQ Sentinel Enterprise Integration Guide 10

11 The Event Source Management Center appears. 8. Click the Table tab. 9. Expand Sentinel > Sentinel Server > Syslog Connector. NetIQ Sentinel Enterprise Integration Guide 11

12 10. Right-click WatchGuard-XTM:Syslog:Map OutPut (universal) and select Open Raw Data Tap. Raw Data Tap displays syslog details. 11. On the Sentinel Web Console, click Real-time Views. NetIQ Sentinel Enterprise Integration Guide 12

13 12. Click Events From Devices. The event view summary appears. 13. Click one summary in a time range. 14. Click the sector diagram for details. NetIQ Sentinel Enterprise Integration Guide 13

14 NetIQ Sentinel Enterprise Integration Guide 14