XMA: How do I configure a FILTER to send EMS data to a SIEM from an alternate collector?

XMA: How do I configure a FILTER to send EMS data to a SIEM from an alternate collector?

This can be done by setting a filter and specifying an install location for the EMS collector.

The INSTALL.LOCATION keyword specifies the installation location of the product (XAC, B24, EMS etc.) that is generating the even. 

With the exception of EMS, the INSTALL.LOCATION is the installation subvolume of the XYGATE Product, (i.e. $SYSTEM.XYGATEAC)

If the product is EMS, the EMS distributor specified is used, instead of the installation subvolume of the product.

INSTALL.LOCATION examples for collectors:
 
INSTALL.LOCATION $0
INSTALL.LOCATION $A0 
INSTALL.LOCATION $B0 
INSTALL.LOCATION $C0 
INSTALL.LOCATION $D0 

FILTER EXAMPLE:
FILTERDEFBEGIN $0A-EMS
STATUS ACTIVE
MOVER_BEGIN
  MOVER_SELECT_BEGIN
   PRODUCT = EMS
  MOVER_SELECT_END
MOVER_END
DATA_BEGIN
 DATA_SELECT_BEGIN
  FILTERTYPE STRINGFILTER
  INSTALL.LOCATION = $A0
DATA_SELECT_END
DATA_END
ACTIONCOLL_BEGIN
ACTION_BEGIN
ACTIONTYPE IPALERT
    IPALERT_IPPROCESS $ZTC0          
    IPALERT_PORT 514                 
    IPALERT_ADDRESS 10.1.1.99    
    IPALERT_PREFIX <158> NODEX $0A EMS@ 
    ALERTSTRING 0@
    ALERTSTRING |(SESSION.RECORDSESSIONKEY)|@
    ALERTSTRING |(SESSION.RECORDINSTALLKEY)|@
    ALERTSTRING |(SESSION.SESSIONID)|@
    ALERTSTRING |(SESSION.FOUNDSESSIONSTART)|@
    ALERTSTRING |(SESSION.FOUNDSESSIONEND)|@
    ALERTSTRING |(SESSION.SESSIONNAME)|@
    ALERTSTRING |(SESSION.PROCESSTHREADID)|@
    ALERTSTRING |(SESSION.PROCESSTHREADID2)|@
    ALERTSTRING |(SESSION.CLIENTPROGRAM)|@
    ALERTSTRING |(SESSION.ANCESTORPROCESSTHREADID)|@
    ALERTSTRING |(SESSION.IPADDRV46)|@|(SESSION.DNSNAME)|@
    ALERTSTRING |(SESSION.CLIENTCURRDIR)|@
    ALERTSTRING |(AUDIT.SUBJECTLOGIN)|@|(AUDIT.SUBJECTSYSTEM)|@
    ALERTSTRING |(AUDIT.TARGETLOGIN)|@|(AUDIT.OBJECTTYPE)|@
    ALERTSTRING |(AUDIT.OBJECTNAME)|@|(AUDIT.OPERATION)|@
    ALERTSTRING |(AUDIT.TERMINAL)|@|(AUDIT.MESSAGEID)|@
    ALERTSTRING |(AUDIT.RULENAME)|@|(AUDIT.USER_DATA)|@
    ALERTSTRING |(AUDIT.RESULT)|@
  ACTION_END
 
**Please note that if you wanted the messages from the same collector to also be handled by another filter you will need to add the line "EVALUATE_MSG CONTINUE" to each filter right beneath the STATUS ACTIVE line. This will cause the next qualifying filter to also be used.





If you are unable to locate the solution needed or if you need additional assistance please Click Here to open a case from our Customer Care Portal.




 

    • Related Articles

    • XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

      If the following PARAM commands were executed at TACL before starting a TELSERV process, XMA could detect TELSERV connection/disconnection operations via EMS Mover that collects EMS messages on <alternate-EMS-collector> and sends Syslog messages to ...

    • XMA: Can XMA movers send data off-box to a SIEM?

      Question: Can Merged Audit (XMA) movers send data to a SIEM (off-box) or is SLSENDER the only mover that can do this? Answer: With a filter configured with an ACTIONTYPE of SYSLOGQ, movers add audit events for products (e.g. XAC, XUA, Safeguard, EMS, ...

    • XMA: Send XMA messages to SIEM via HPE SSL proxy

      Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

    • XMA: Data selection criteria to avoid sending $0 messages to a target SIEM

      The FILTER Data selection criteria for the ACTIONTYPE SYSLOGQ filter definition to avoid sending EMS messages from the collector $0 to the target SIEM are as follows: MOVER_BEGIN MOVER_SELECT_BEGIN PRODUCT = EMS MOVER_SELECT_END MOVER_END DATA_BEGIN ...

    • XSH how to redirect events to an alternate collector

      To redirect the messages to an alternate collector using the PARAM EMS^COLLECTOR. TACL> PARAM EMS^COLLECTOR $<collector> TACL> Volume <XSH Installation Volume/Subvolume> TACL> RUN XYGATESH.STARTUP If this article did not provide a solution, please ...