XMA: Events sent to SIEM are not delimited

XMA: Events sent to SIEM are not delimited

1. Check the IPALERT_MSGDELIMITER setting for the filter is correct.   This value must match what is expected on the SIEM side and should be provided by the SIEM administrator

2. Check the ACTIONTYPE value is correct. 

    a. If the SIEM is expecting TCP traffic, it must be SYSLOGQ.  IPALERT_MSGDELIMITER should be set to the value provided by the SIEM administrator

    b. If the SIEM is expecting UDP traffic, it must be IPALERT.  IPALERT_MSGDELIMITER can be commented out or removed for the filter at issue as it is not needed for UDP traffic.



If you are unable to locate the solution needed or if you need additional assistance please Click Here to open a case from our Customer Care Portal.


    • Related Articles

    • XMA: Can XMA movers send data off-box to a SIEM?

      Question: Can Merged Audit (XMA) movers send data to a SIEM (off-box) or is SLSENDER the only mover that can do this? Answer: With a filter configured with an ACTIONTYPE of SYSLOGQ, movers add audit events for products (e.g. XAC, XUA, Safeguard, EMS, ...

    • XMA: How to view contents of data sent to Splunk

      The following SQL Query is all the customer will need to run in order to see the contents of the data sent to Splunk. Set list_count 0; select alertedgmt, message FROM SYSLOGQ where cast(alertedgmt as date) = date 'yyyy-mm-dd' BROWSE ACCESS; detail ...

    • XMA: Send XMA messages to SIEM via HPE SSL proxy

      Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

    • XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

      If the following PARAM commands were executed at TACL before starting a TELSERV process, XMA could detect TELSERV connection/disconnection operations via EMS Mover that collects EMS messages on <alternate-EMS-collector> and sends Syslog messages to ...

    • XMA: How does XMA determine the severity of events

      The Severity fields are set by the generating products. Specific information related to the Data Mapping for specific movers can be found in the Appendix G. Data Mapping of the XMA Manual. This appendix goes through the mappings for fields for Movers ...