Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Configuring HP Network Automation Software to Communicate with JSA

 

Configure HP Network Automation Software to send LEEF events to JSA.

You must have administrator access to the HP Network Automation Software user interface.

  1. Log in to the HP Network Automation Software user interface.
  2. In the Admin menu, select Event Notification & Response Rules.
  3. Click New Event Notification & Respone Rule.
  4. Configure the parameters for HP Network Automation.

    The following table describes the parameter values to send LEEF events to JSA:

    Parameter

    Value

    Add Email and Event Rule named

    You can use any string. For example, JSA_logs.

    To take this action

    Select Send Syslog Message from the list.

    When the following events occur

    1. Select all of the events.

    2. Enable the of any importance button.

    3. To take action for For Policy No-Compliance events, enable the for all policies button.

    Rule Status

    Enable the Active button.

    Syslog Hostname

    JSA host name or IP address.

    Syslog Port

    514

    Syslog Message

    LEEF:1.0|HP|Network
     Automation|v10|
    $EventType$|devTime=
    $EventDate$
    	devTimeFormat=EE
    E MMM dd HH:mm:ss Z
     yyyy	src=$IPAddress$
     eventId=$EventID$
    	usrName=$EventUserName$
    	eventText=
    $EventText$

    Note: All event attributes are tab delimited. For example, devTime, devTimeFormat, and more. Copy the Syslog Message value into a text editor, and then verify that the attributes are tab delimited and remove any new line characters.

    Note: The version number v10 in the LEEF header can be replaced with the exact version of your HP Network Automation software. If you change any other components of the format string, events might not normalize or unknown events might occur.

  5. Click Save.