Symantec 10521146 - Network Security 7120 Administration Manual page 286

286 Advanced configuration
Integrating third-party events
To download instructions for configuring Symantec Decoy Server to send events
to Symantec Network Security, see the following web site:
http://www.symantec.com/techsupp/enterprise/products/mantrap/files.html
To integrate Symantec Decoy Server events into Symantec Network Security
1 Configure the alerting response policies for the Symantec Decoy Server
cages. Based on these alerting response policies, Symantec Decoy Server
sends events to Symantec Network Security, and these events appear in the
Network Security console. For example, configure a cage to send all
and
User Exec File Opened for Writing
console.
2 In the Network Security console
address that will send event data to Symantec Network Security; that is, a
separate node for each cage and host.
See "Adding or editing Smart Agent objects"
3 Apply Symantec Network Security response policy rules to the Symantec
Decoy Server events.
See "Setting response actions"
Note: SuperUsers can integrate Symantec Decoy Server events; Administrators,
StandardUsers, and RestrictedUsers cannot. See
page 319 for more about permissions.
Launching from a new location
This section describes how to launch the Symantec Decoy Server console from a
new location on the network.
To launch the Symantec Decoy Server console from a new location
1 Right-click any external sensor object in the topology tree, and click Start
Decoy Console.
2 The first time, a Decoy Console Not Found message appears. Click OK.
3 In Select the Symantec Decoy Server Console Directory, navigate to the
directory containing
This file is typically located in
4 In Start Decoy Console, click Yes to confirm the path to the jar file.
After launching the Symantec Decoy Server console from this new location,
the location of the
create an external sensor node for each IP
,
on page 141.
, and click Open.
mtadmin.jar
Program Files\Symantec\Mantrap
file is stored in memory.
mtadmin.jar
events to the Network Security
on page 105.
"User groups reference"
Root
on
.