XMA: Can XMA movers send data off-box to a SIEM?

• Related Articles

• XMA: Send XMA messages to SIEM via HPE SSL proxy

  Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

• XMA: Data selection criteria to avoid sending $0 messages to a target SIEM

  The FILTER Data selection criteria for the ACTIONTYPE SYSLOGQ filter definition to avoid sending EMS messages from the collector $0 to the target SIEM are as follows: MOVER_BEGIN MOVER_SELECT_BEGIN PRODUCT = EMS MOVER_SELECT_END MOVER_END DATA_BEGIN ...

• XMA: How to modify XMA Log Adapter filters to send the same data to two different SIEMs simultaneously

  ** Please read before beginning this procedure ** 1.This procedure assumes that the Log Adapter (LAF) filters have already been installed. If they have not been installed, this procedure cannot be performed. If this is the case, please see the ...

• XMA: Can IPALERT_IPPROCESS be used to specify a TCP name process when sending data to a SIEM via TCP (ACTIONTYPE SYSLOGQ)?

  IPALERT_IPPROCESS can only be used for filters with an ACTIONTYPE IPALERT (UDP). IPALERT_IPPROCESS cannot be used to assign an TCP process name to a filter when sending data to a SIEM via TCP (ACTIONTYPE SYSLOGQ). This applies to XMA 2.60 and earlier ...

• XMA: SLSENDER Error unable to send messages to host.

  The SYSLOGQ database table in the XMADAT subvolume has 2 columns that can be used to determine if messages are being sent to the SIEM. ENTRYGMT is the timestamp when the message was inserted into the queue by a mover. ALERTEDGMT is the timestamp when ...