Novell SENTINEL RAPID DEPLOYMENT 6.1 - 12-2009 User Manual page 400

Data aggregated by the Collectors in the form of events is subsequently normalized and transformed
into XML format, enriched with a series of metadata (that is, data about data) using a set of business
relevance services, and propagated to the server side for further computational analysis through the
message bus platform. The collection and enrichment layer consists of the following components:
"Connectors and Collectors" on page 400
"Collector Manager and Engine" on page 400
"Collector Builder" on page 400
"Common Services" on page 402
Connectors and Collectors
A Connector is a concentrator or multiplexed adapter that connects the Collector Engine to the
actual monitored devices.
Collectors are the component-level aggregators of event data from a specific source. Sentinel
primarily supports remote "Collector-less" connections to sources; however, Collectors can be
deployed on specific devices where a remote approach is less efficient.
Collectors are controlled from the Sentinel Control Center, which orchestrates the communication
between the Collectors and the Sentinel platform for real time analysis, correlation computation and
incident response.
Collector Manager and Engine
Collector Manager manages the Collectors, monitors system status messages, and performs event
filtering as needed. The main functions of the Collector Manager include transforming events,
adding business relevance to events through taxonomy, performing global filtering on events,
routing events, and sending health messages to the Sentinel server.
A Collector Engine is the interpreter component that parses the Collector code.
Collector Builder
The Collector Builder is a standalone application that is used to build, configure, and debug
Collectors. This application serves as an integrated development environment that allows the user to
create new Collectors to parse data from source devices, using a special-purpose interpretive
language designed to handle the nature of network and security events.
ESM introduces a new hierarchy of deployment objects that allows users to group multiple
connections into sets. The hierarchy is as follows:
400 Sentinel 6.1 Rapid Deployment User Guide