Intrusion Defense Firewall 1.2 User's Guide - Trend Micro? Online ...

Configure Syslog Integration
IDF supports SIEM integration through syslog. Syslog is a method of forwarding log information over an IP
network, typically using UDP, to a Syslog server listening on port 514.
Enabling Syslog forwarding in the IDF Server Plug-in does not affect default logging. That is,
enabling syslog will not "turn off" the normal logging mechanisms.
Setting up a Syslog on Red Hat Enterprise
The following steps describe how to configure Syslog on Red Hat Enterprise to receive logs from IDF Client
Plug-ins.
1. Log in as root
2. Execute: vi /etc/syslog.conf
3. Add the following two lines of text to the end of the syslog.conf:
o #Save IDF Server Plug-in logs to IDF Server.log
o Local4.* /var/log/IDF Server.log
4. Save the file and exit
5. Create the /var/log/IDF Server.log file by typing touch /var/log/IDF
Server.log
6. Set the permissions on the IDF Server log so that syslog can write to it
7. Execute: vi /etc/sysconfig/syslog
8. Modify the line "SYSLOGD_OPTIONS" and add a "-r" to the options
9. Save the file and exit
10. Restart syslog: /etc/init.d/syslog restart
When Syslog is functioning you will see logs populated in: /var/log/IDF Server.log
IDF Server Plug-in Settings
You can configure IDF Server Plug-in to instruct all managed Computers to send logs to the Syslog
computer, or you can configure individual Computers independently.
To configure the Server Plug-in to instruct all managed Computers to use Syslog, go to the System >
System Settings screen and click the Notifications tab. In the panel called "System Event Notification",
1. place a check in the "Forward System Events to a remote Computer (via Syslog) " checkbox,
2. enter the hostname or the IP address of the Syslog computer,
3. enter which UDP port to use (usually 514),
4. select which Syslog facility to use (Local4 from the Red Hat example above),
5. select the log format (Trend Micro, or Common Event Format (CEF))
Common Event Format (CEF) is a format sponsored by Arcsight (www.arcsight.com). The
specification can be found on their Web site.
You have now configured the IDF Server Plug-in to instruct all existing and new Computers to use remote
Syslog by default.
This default setting can be overridden for specific Security Profiles and on individual Computers. To
override on a Computer, find the Computer you want to configure on the Computers screen and double-
© Copyright 2010 Trend Micro Inc. www.trendmicro.com
All rights reserved. - 88 -