Cisco Cisco Firepower Management Center 2000 Guia Do Programador

Página de 536
 
6-15
FireSIGHT eStreamer Integration Guide
 
Chapter 6      Configuring eStreamer
  Configuring the eStreamer Reference Client
Sending Records to an SNMP Server Using the Reference Client
You can also use the reference client to stream intrusion event data to an SNMP server. Use the 
-f
 option 
to indicate the name of the SNMP trap server that should receive events. Note that this output method 
requires a binary named 
snmptrapd
 in the path and therefore only works on UNIX-like systems.
Use the following syntax to send intrusion events to an SNMP server:
./ssl_test.pl eStreamerServerIPAddress -o snmp 
 
-f SNMPServerName
For example, to send events to an SNMP server at 10.10.0.3 using events streamed from an eStreamer 
server with an IP address of 10.10.0.4:
./ssl_test.pl 10.10.0.4 -o snmp -f 10.10.0.3
Logging Events to the Syslog Using the Reference Client
You can also use the reference client to stream intrusion events to the local syslog server on the client. 
Use the following syntax to send events to the syslog:
./ssl_test.pl eStreamerServerIPAddress -o syslog
For example, to log events streamed from an eStreamer server with an IP address of 10.10.0.4:
./ssl_test.pl 10.10.0.4 -o syslog
Connecting to an IPv6 Address
You can use the reference client to connect to a Defense Center with an IPv6 address through the primary 
management interface. You must have the Socket6 and IO::Socket::INET6 Perl modules installed on the 
client machine and use the
-ipv6
 option or the shortened form 
-i
.
Use the following syntax to specify an IPv6 address using the ssl_test.pl script:
./ssl_test.pl -ipv6 eStreamerServerIPAddress
or
./ssl_test.pl -i eStreamerServerIPAddress
For example, to connect to a Defense Center with the IPv6 address 
2001:470:e09c:20:7c1e:5248:1bf7:2ea0
 use the following:
./ssl_test.pl -ipv6 2001:470:e09c:20:7c1e:5248:1bf7:2ea0