XMA: Can IPALERT_IPPROCESS be used to specify a TCP name process when sending data to a SIEM via TCP (ACTIONTYPE SYSLOGQ)?

• Related Articles

• XMA: Can XMA movers send data off-box to a SIEM?

  Question: Can Merged Audit (XMA) movers send data to a SIEM (off-box) or is SLSENDER the only mover that can do this? Answer: With a filter configured with an ACTIONTYPE of SYSLOGQ, movers add audit events for products (e.g. XAC, XUA, Safeguard, EMS, ...

• XMA: Send XMA messages to SIEM via HPE SSL proxy

  Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

• XMA: How to modify XMA Log Adapter filters to send the same data to two different SIEMs simultaneously

  ** Please read before beginning this procedure ** 1.This procedure assumes that the Log Adapter (LAF) filters have already been installed. If they have not been installed, this procedure cannot be performed. If this is the case, please see the ...

• XMA: Data selection criteria to avoid sending $0 messages to a target SIEM

  The FILTER Data selection criteria for the ACTIONTYPE SYSLOGQ filter definition to avoid sending EMS messages from the collector $0 to the target SIEM are as follows: MOVER_BEGIN MOVER_SELECT_BEGIN PRODUCT = EMS MOVER_SELECT_END MOVER_END DATA_BEGIN ...

• XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

  If the following PARAM commands were executed at TACL before starting a TELSERV process, XMA could detect TELSERV connection/disconnection operations via EMS Mover that collects EMS messages on <alternate-EMS-collector> and sends Syslog messages to ...