Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Sophos PureMessage

 

The Sophos PureMessage DSM for JSA accepts events by using Java Database Connectivity (JDBC).

JSA records all relevant quarantined email events. This document provides information about configuring JSA to access the Sophos PureMessage database by using the JDBC protocol.

JSA supports the following Sophos PureMessage versions:

  • Sophos PureMessage for Microsoft Exchange - Stores events in a Microsoft SQL Server database that is specified as savexquar.

  • Sophos PureMessage for Linux - Stores events in a PostgreSQL database that is specified as pmx_quarantine.

Here's information on integrating JSA with Sophos:

Integrating JSA with Sophos PureMessage for Microsoft Exchange

You can integrate JSA with Sophos PureMessage for Microsoft Exchange.

  1. Log in to the Microsoft SQL Server command-line interface (CLI):

    osql -E -S localhost\sophos

  2. Type which database you want to integrate with JSA:

    use savexquar; go

  3. Type the following command to create a SIEM view in your Sophos database to support JSA:

After you create your SIEM view, you must configure JSA to receive event information by using the JDBC protocol. To configure the Sophos PureMessage DSM with JSA, see Configure a JDBC log source for Sophos PureMessageYou can configure JSA to access the Sophos PureMessage for Microsoft Exchange database using the JDBC protocol..

Configure a JDBC Log Source for Sophos PureMessage

You can configure JSA to access the Sophos PureMessage for Microsoft Exchange database using the JDBC protocol.

  1. Log in to JSA.
  2. Click the Admin tab.
  3. On the navigation menu, click Data Sources.

    The Data Sources pane is displayed.

  4. Click the Log Sources icon.

    The Log Sources window is displayed.

  5. Click Add.

    The Add a log source window is displayed.

  6. From the Log Source Type list, select Sophos PureMessage.
  7. From the Protocol Configuration list, select JDBC.Note

    You must refer to the database configuration settings on your Sophos PureMessage device to define the parameters required to configure the Sophos PureMessage DSM in JSA.

  8. Configure the following values:

    Table 1: Sophos PureMessage JDBC Parameters

    Parameter

    Description

    Log Source Identifier

    Type the identifier for the log source. Type the log source identifier in the following format:

    <Sophos PureMessage Database>@<Sophos PureMessage Database Server IP or Host Name>

    Where:

    • <Sophos PureMessage Database> is the database name, as entered in the Database Name parameter.

    • <Sophos PureMessage Database Server IP or Host Name> is the host name or IP address for this log source, as entered in the IP or Hostname parameter.

    When defining a name for your log source identifier, you must use the values of the Database and Database Server IP address or host name of the Sophos PureMessage device.

    Database Type

    From the list, select MSDE.

    Database Name

    Type savexquar.

    IP or Hostname

    Type the IP address or host name of the Sophos PureMessage server.

    Port

    Type the port number used by the database server. The default port for MSDE is 1433. Sophos installations typically use 24033. You can confirm port usage using the SQL Server Configuration Manager utility. For more information, see your vendor documentation.

    The JDBC configuration port must match the listener port of the Sophos database. The Sophos database must have incoming TCP connections enabled to communicate with JSA.

    If you define a database instance in the Database Instance parameter, you must leave the Port parameter blank. You can only define a database instance if the database server uses the default port of 1433. This is not the standard Sophos configuration.

    Username

    Type the user name required to access the database.

    Password

    Type the password required to access the database. The password can be up to 255 characters in length.

    Confirm Password

    Confirm the password required to access the database. The confirmation password must be identical to the password entered in the Password parameter.

    Authentication Domain

    If you select MSDE as the Database Type and the database is configured for Windows, you must define a Window Authentication Domain. Otherwise, leave this field blank.

    Database Instance

    Optional. Type the database instance, if you have multiple SQL server instances on your database server.

    If you define a port number other than the default in the Port parameter, or block access to port 1434 for SQL database resolution, you must leave the Database Instance parameter blank.

    Table Name

    Type siem_view as the name of the table or view that includes the event records.

    Select List

    Type * for all fields from the table or view.

    You can use a comma-separated list to define specific fields from tables or views, if it is needed for your configuration. The list must contain the field that is defined in the Compare Field parameter. The comma-separated list can be up to 255 alphanumeric characters in length. The list can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).

    Compare Field

    Type ID. The Compare Field parameter is used to identify new events added between queries to the table.

    Use Prepared Statements

    Select this check box to use prepared statements.

    Prepared statements allows the JDBC protocol source to set up the SQL statement one time, then run the SQL statement many times with different parameters. For security and performance reasons, we recommend that you use prepared statements.

    Clearing this check box requires you to use an alternative method of querying that does not use pre-compiled statements.

    Start Date and Time

    Optional. Type the start date and time for database polling.

    The Start Date and Time parameter must be formatted as yyyy-MM-dd HH:mm with HH specified using a 24-hour clock. If the Start Date and Time parameter is clear, polling begins immediately and repeats at the specified polling interval.

    Polling Interval

    Type the polling interval, which is the amount of time between queries to the event table. The default polling interval is 10 seconds.

    You can define a longer polling interval by appending H for hours or M for minutes to the numeric value. The maximum polling interval is 1 week in any time format. Numeric values entered without an H or M poll in seconds.

    Use Named Pipe Communication

    Clear the Use Named Pipe Communication check box.

    When using a Named Pipe connection, the user name and password must be the appropriate Windows authentication username and password and not the database user name and password. Also, you must use the default Named Pipe.

    Database Cluster Name

    If you select the Use Named Pipe Communication check box, the Database Cluster Name parameter is displayed. If you are running your SQL server in a cluster environment, define the cluster name to ensure Named Pipe communication functions properly.

    Note

    Selecting a value greater than 5 for the Credibility parameter weights your Sophos PureMessage log source with a higher importance compared to other log sources in JSA.

  9. Click Save.
  10. On the Admin tab, click Deploy Changes.

Integrating JSA with Sophos PureMessage for Linux

You can integrate JSA with Sophos PureMessage for Linux.

  1. Navigate to your Sophos PureMessage PostgreSQL database directory:

    cd /opt/pmx/postgres-8.3.3/bin

  2. Access the pmx_quarantine database SQL prompt:

    ./psql -d pmx_quarantine

  3. Type the following command to create a SIEM view in your Sophos database to support JSA:

After you create your database view, you must configure JSA to receive event information by using the JDBC protocol.

Configuring a Log Source for Sophos PureMessage for Microsoft Exchange

You can configure JSA to access the Sophos PureMessage database using the JDBC protocol:

  1. Log in to JSA.
  2. Click the Admin tab.
  3. On the navigation menu, click Data Sources.

    The Data Sources pane is displayed.

  4. Click the Log Sources icon.

    The Log Sources window is displayed.

  5. Click Add.

    The Add a log source window is displayed.

  6. From the Log Source Type list, select Sophos PureMessage.
  7. From the Protocol Configuration list, select JDBC.Note

    You must refer to the Configure Database Settings on your Sophos PureMessage to define the parameters required to configure the Sophos PureMessage DSM in JSA.

  8. Configure the following values:

    Parameter

    Description

    Log Source Identifier

    Type the identifier for the log source. Type the log source identifier in the following format:

    <Sophos PureMessage Database>@<Sophos PureMessage Database Server IP or Host Name>

    Where:

    • <Sophos PureMessage Database> is the database name, as entered in the Database Name parameter.

    • <Sophos PureMessage Database Server IP or Host Name> is the hostname or IP address for this log source, as entered in the IP or Hostname parameter.

    When defining a name for your log source identifier, you must use the values of the Database and Database Server IP address or host name of the Sophos PureMessage device.

    Database Type

    From the list, select Postgres.

    Database Name

    Type pmx_quarantine.

    IP or Hostname

    Type the IP address or host name of the Sophos PureMessage server.

    Port

    Type the port number used by the database server. The default port is 1532.

    The JDBC configuration port must match the listener port of the Sophos database. The Sophos database must have incoming TCP connections enabled to communicate with JSA.

    Username

    Type the user name required to access the database.

    Password

    Type the password required to access the database. The password can be up to 255 characters in length.

    Confirm Password

    Confirm the password required to access the database. The confirmation password must be identical to the password entered in the Password parameter.

    Database Instance

    Optional. Type the database instance, if you have multiple SQL server instances on your database server.

    If you use a non-standard port in your database configuration, or have blocked access to port 1434 for SQL database resolution, you must leave the Database Instance parameter blank in your configuration.

    Table Name

    Type siem_view as the name of the table or view that includes the event records.

    Select List

    Type * for all fields from the table or view.

    You can use a comma-separated list to define specific fields from tables or views, if required for your configuration. The list must contain the field defined in the Compare Field parameter. The comma-separated list can be up to 255 alphanumeric characters in length. The list can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).

    Compare Field

    Type ID.

    The Compare Field parameter is used to identify new events added between queries to the table.

    Use Prepared Statements

    Select this check box to use prepared statements.

    Prepared statements allows the JDBC protocol source to set up the SQL statement one time, then run the SQL statement many times with different parameters. For security and performance reasons, we recommend that you use prepared statements.

    Clearing this check box requires you to use an alternative method of querying that does not use pre-compiled statements.

    Start Date and Time

    Optional. Type the start date and time for database polling.

    The Start Date and Time parameter must be formatted as yyyy-MM-dd HH: mm with HH specified by using a 24-hour clock. If the Start Date and Time parameter is clear, polling begins immediately and repeats at the specified polling interval.

    Polling Interval

    Type the polling interval, which is the amount of time between queries to the event table. The default polling interval is 10 seconds.

    You can define a longer polling interval by appending H for hours or M for minutes to the numeric value. The maximum polling interval is 1 week in any time format. Numeric values entered without an H or M poll in seconds.

    Note

    Selecting a value greater than 5 for the Credibility parameter weights your Sophos PureMessage log source with a higher importance compared to other log sources in JSA.

  9. Click Save.
  10. On the Admin tab, click Deploy Changes.