XMA: Is additional licensing required to install a log adapter in order to write data to a SIEM?

• Related Articles

• XMA: How to modify XMA Log Adapter filters to send the same data to two different SIEMs simultaneously

  ** Please read before beginning this procedure ** 1.This procedure assumes that the Log Adapter (LAF) filters have already been installed. If they have not been installed, this procedure cannot be performed. If this is the case, please see the ...

• XMA: Send XMA messages to SIEM via HPE SSL proxy

  Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...

• XMA: When does write access required after XMA installation?

  If the XMA installation has been done and the XMA catalog has been created "READ" access to the system catalog will be sufficient. Write Access will be needed again If the customer wants to uninstall XMA or change the XMA Catalog location. If you are ...

• XMA: Data selection criteria to avoid sending $0 messages to a target SIEM

  The FILTER Data selection criteria for the ACTIONTYPE SYSLOGQ filter definition to avoid sending EMS messages from the collector $0 to the target SIEM are as follows: MOVER_BEGIN MOVER_SELECT_BEGIN PRODUCT = EMS MOVER_SELECT_END MOVER_END DATA_BEGIN ...

• XMA:Example of an XMA filter that sends TELSERV connection/disconnect operations to SIEM

  If the following PARAM commands were executed at TACL before starting a TELSERV process, XMA could detect TELSERV connection/disconnection operations via EMS Mover that collects EMS messages on <alternate-EMS-collector> and sends Syslog messages to ...