UDLA - Symantec CSP
Symantec CSP allows organizations to monitor and protect physical and virtual data centers using policy-based controls. Through a combination of host-based intrusion detection (HIDS), intrusion prevention (HIPS), and least-privilege access control, organizations can proactively safeguard heterogeneous server environments and the information they contain.
Prerequisites
Symantec CSP can be configured to store its event logs in a Microsoft SQL database. Collection from a Microsoft SQL database requires:
- Universal Database Log Adapter (UDLA) Log Source
- A LogRhythm Agent to collect the logs
- Access to the Microsoft SQL database that Symantec CSP uses for storing event logs
Before you begin the configuration procedure, identify the LogRhythm System Monitor Agent that will be used to collect the logs from Symantec CSP.
Configure Symantec™ Critical System Protection (CSP)
Make available an account that the LogRhythm System Monitor will use to access the Microsoft SQL database. We recommend using or creating an account that has read-only access into the tables required for collection.
After you configure the device, you must also configure LogRhythm according to the instructions provided on the overview page of this guide. You must use a LogRhythm System Monitor to collect the logs. The System Monitor does not need to reside on the Symantec CSP server, but it must be able to establish a network ODBC (Open Database Connectivity) connection.
Only Global Admins or Restricted Admins with elevated View and Manage privileges can take this action.
Before you begin, download the Symantec CSP XML Configuration File. You will import this file later to populate the UDLA configuration fields for the Log Source.
The name of the log message source is UDLA – Symantec CSP. In addition, when configuring this log source:
- For Log Message Processing Mode, select MPE Processing Enabled, Event Forwarding Enabled.
- For Log Message Processing Engine (MPE) Policy, select LogRhythm Default.
- On the UDLA Settings tab, enter the following:
Click Import, and then browse to and open the XML file that you downloaded from LogRhythm.
Pasting UDLA configuration settings into the Log Message Source Properties dialog box may produce unprintable or hidden characters that are not supported by UDLA.
- If you want to validate the current settings, click Test.
If the test fails, verify the connection settings and that all values were entered correctly. - When the test passes, close the Test dialog box.