Extreme NetSight Automatic Security Manager

The Extreme NetSight Automatic Security Manager DSM for IBM QRadar accepts events by using syslog.

1. Log in to the Automatic Security Manager user interface.
2. Click the Automated Security Manager icon to access the Automated Security Manager Configuration window.
   Note: You can also access the Automated Security Manager Configuration window from the Tool menu.
3. From the left navigation menu, select Rule Definitions.
4. Choose one of the following options:

   If a rule is configured, highlight the rule. Click Edit.

5. To create a new rule, click Create.
6. Select the Notifications check box.
7. Click Edit.

   The Edit Notifications window is displayed.

8. Click Create.

   The Create Notification window is displayed.

9. Using the Type list, select Syslog.
10. In the Syslog Server IP/Name field, type the IP address of the device that receives syslog traffic.
11. Click Apply.
12. Click Close.
13. In the Notification list, select the notification that is configured.
14. Click OK.
15. You are now ready to configure the log source in QRadar.

    To configure QRadar to receive events from an Extreme NetSight Automatic Security Manager device, select Extreme NetsightASM from the Log Source Type list.

    For more information about your Extreme NetSight Automatic Security Manager device, see your vendor documentation.