Symantec System Center
The Symantec System Center (SSC) DSM for JSA retrieves events from an SSC database by using a custom view that is created for JSA.
JSA records all SSC events. You must configure the SSC database with a user that has read and write privileges for the custom JSA view to be able to poll the view for information. Symantec System Center (SSC) supports only the JDBC protocol.
Configuring a Database View for Symantec System Center
A database view is required by the JDBC protocol to poll for SSC events.
- In the Microsoft SQL Server database that is used by the
SSC device, configure a custom default view to support JSA:
The database name must not contain any spaces.
CREATE VIEW dbo.vw_qradar AS SELECT
dbo.alerts.Idx AS idx,
dbo.inventory.IP_Address AS ip,
dbo.inventory.Computer AS computer_name,
dbo.virus.Virusname AS virus_name,
dbo.alerts.Filepath AS filepath,
dbo.alerts.NoOfViruses AS no_of_virus,
dbo.actualaction.Actualaction AS [action],
dbo.alerts.Alertdatetime AS [date],
dbo.clientuser.Clientuser AS user_name FROM
dbo.alerts INNER JOIN
dbo.virus ON dbo.alerts.Virusname_Idx = dbo.virus.Virusname_Idx INNER JOIN
dbo.inventory ON dbo.alerts.Computer_Idx = dbo.inventory.Computer_Idx INNER JOIN
dbo.actualaction ON dbo.alerts.Actualaction_Idx =
dbo.actualaction.Actualaction_Idx INNER JOIN
dbo.clientuser ON dbo.alerts.Clientuser_Idx = dbo.clientuser.Clientuser_Idx
After you create your custom view, you must configure JSA to receive event information by using the JDBC protocol.
Configuring a Log Source
You can configure JSA to access the SSC database by using the JDBC protocol.
- Log in to JSA.
- Click the Admin tab.
- On the navigation menu, click Data Sources.
- Click the Log Sources icon.
- Click Add.
- Using the Log Source Type list, select Symantec System Center.
- Using the Protocol Configuration list, select JDBC.
- Configure the following parameters:
Table 1: Symantec System Center JDBC Parameters
Log Source Identifier
Type the identifier for the log source. Type the log source identifier in the following format:
<SSC Database>@<SSC Database Server IP or Host Name>
<SSC Database> is the database name, as entered in the Database Name parameter.
<SSC Database Server IP or Host Name> is the host name or IP address for this log source, as entered in the IP or Hostname parameter.
From the list, select MSDE.
Type Reporting as the name of the Symantec System Center database.
IP or Hostname
Type the IP address or host name of the Symantec System Center SQL Server.
Type the port number that is used by the database server. The default port for MSDE is 1433.
The JDBC configuration port must match the listener port of the Symantec System Center database. The Symantec System Center database must have incoming TCP connections that are enabled to communicate with JSA.
If you define a Database Instance when you use MSDE as the database type, you must leave the Port parameter blank in your configuration.
Type the user name that is required to access the database.
Type the password that is required to access the database. The password can be up to 255 characters in length.
Confirm the password that is required to access the database. The confirmation password must be identical to the password entered in the Password parameter.
If you select MSDE as the Database Type and the database is configured for Windows, you must define a Windows Authentication Domain. Otherwise, leave this field blank.
Optional. Type the database instance, if you have multiple SQL server instances on your database server.
If you use a non-standard port in your database configuration, or block access to port 1434 for SQL database resolution, you must leave the Database Instance parameter blank in your configuration.
Type vw_qradar as the name of the table or view that includes the event records.
Type * for all fields from the table or view.
You can use a comma-separated list to define specific tables or views, if you need it for your configuration. The comma-separated list can be up to 255 alphanumeric characters in length. The list can include the following special characters: dollar sign (
$), number sign (
#), underscore (
_), en dash (
-), and period(
Type idx as the compare field. The compare field is used to identify new events added between queries to the table.
Start Date and Time
Optional. Type the start date and time for database polling.
The Start Date and Time parameter must be formatted as yyyy-MM-dd HH: mm with HH specified you use a 24-hour clock. If the start date or time is clear, polling begins immediately and repeats at the specified polling interval.
Use Prepared Statements
Select this check box to use prepared statements.
Prepared statements allow the JDBC protocol source to set up the SQL statement one time, then run the SQL statement many times with different parameters. For security and performance reasons, it is suggested that you use prepared statements.
Clearing this check box requires you to use an alternative method of querying that does not use pre-compiled statements.
Type the polling interval, which is the amount of time between queries to the event table. The default polling interval is 10 seconds.
You can define a longer polling interval by appending H for hours or M for minutes to the numeric value. The maximum polling interval is 1 week in any time format. Numeric values that are entered without an H or M poll in seconds.
Type the number of Events Per Second (EPS) that you do not want this protocol to exceed. The default value is 20000 EPS.
Use Named Pipe Communication
Clear the Use Named Pipe Communication check box.
When using a Named Pipe connection, the user name and password must be the appropriate Windows authentication user name and password and not the database user name and password. Also, you must use the default Named Pipe.
Database Cluster Name
If you select the Use Named Pipe Communication check box, the Database Cluster Name parameter is displayed. If you are running your SQL server in a cluster environment, define the cluster name to ensure Named Pipe communication functions properly.
Selecting a value greater than 5 for the Credibility parameter weights your Symantec System Center log source with a higher importance compared to other log sources in JSA.
- Click Save.
- On the Admin tab, click Deploy Changes.
The configuration is complete.