You can integrate a Cisco Security Agent (CSA) server with JSA.
The Cisco CSA DSM accepts events by using syslog, SNMPv1, and SNMPv2. JSA records all configured Cisco CSA alerts.
Configuring Syslog for Cisco CSA
Configuration of your Cisco CSA server to forward events.
Take the following steps to configure your Cisco CSA server to forward events:
- Open the Cisco CSA user interface.
- Select Events >Alerts.
- Click New.
The Configuration View window is displayed.
- Type in values for the following parameters:
Name Type a name that you want to assign to your configuration.
Description Type a description for the configuration. This step is not a requirement.
- From the Send Alerts, select the event set from the list to generate alerts.
- Select the SNMP check box.
- Type a Community name.
The Community name that is entered in the CSA user interface must match the Community name that is configured on JSA. This option is only available for the SNMPv2 protocol.
- For the Manager IP address parameter, type the IP address of JSA.
- Click Save.
You are now ready to configure the log source in JSA.
Configuring a Log Source
JSA automatically discovers and creates a log source for syslog events from Cisco CSA appliances.
To manually configure a syslog log source for Cisco CSA, take the following configuration steps, which are optional:
- Log in to JSA.
- Click the Admin tab.
- On the navigation menu, click Data Sources.
The Data Sources pane is displayed.
- Click the Log Sources icon.
The Log Sources window is displayed.
- Click Add.
The Add a log source window is displayed.
- In the Log Source Name field, type a name for your log source.
- In the Log Source Description field, type a description for the log source.
- From the Log Source Type list, select Cisco CSA.
- Using the Protocol Configuration list, select Syslog.
The syslog protocol configuration is displayed.
- Configure the following values:
Table 1: Syslog Parameters
Log Source Identifier
Type the IP address or host name for the log source as an identifier for events from your Cisco CSA appliance.
- Click Save.
- On the Admin tab, click Deploy Changes.
The configuration is complete.