XMA: Data selection criteria to avoid sending $0 messages to a target SIEM

• Related Articles

• XMA: Send XMA messages to SIEM via HPE SSL proxy

  Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

• XMA: Sending Syslog messages from XMA to 2 SIEM with a single filter define

  To send Syslog messages to 2 SIEM, it's required to have two ACTION having each one set with one of the SIEM IP Address. ACTIONCOLL_BEGIN ACTION_BEGIN ACTIONTYPE IPALERT ! SYSLOGQ .... IPALERT_ADDRESS <IP Address-A> .... ACTION_END ACTION_BEGIN ...

• XMA: SLSENDER Error unable to send messages to host.

  The SYSLOGQ database table in the XMADAT subvolume has 2 columns that can be used to determine if messages are being sent to the SIEM. ENTRYGMT is the timestamp when the message was inserted into the queue by a mover. ALERTEDGMT is the timestamp when ...

• XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

  If the following PARAM commands were executed at TACL before starting a TELSERV process, XMA could detect TELSERV connection/disconnection operations via EMS Mover that collects EMS messages on <alternate-EMS-collector> and sends Syslog messages to ...

• XMA: Can IPALERT_IPPROCESS be used to specify a TCP name process when sending data to a SIEM via TCP (ACTIONTYPE SYSLOGQ)?

  IPALERT_IPPROCESS can only be used for filters with an ACTIONTYPE IPALERT (UDP). IPALERT_IPPROCESS cannot be used to assign an TCP process name to a filter when sending data to a SIEM via TCP (ACTIONTYPE SYSLOGQ). This applies to XMA 2.60 and earlier ...