Integrate Symantec Messaging Gateway - Netsurion

Integrate Symantec Messaging Gateway EventTracker v9.x and above Publication Date: May 9, 2018

Integrate Symantec Messaging Gateway Abstract This guide provides instructions to configure a Symantec Messaging Gateway to send its syslog to EventTracker Enterprise Scope The configurations detailed in this guide are consistent with EventTracker Enterprise version v9.x or above and Symantec Messaging Gateway 10.x or above. Audience Administrators who are assigned the task to monitor Symantec Messaging Gateway events using EventTracker. The information contained in this document represents the current view of EventTracker. on the issues discussed as of the date of publication. Because EventTracker must respond to changing market conditions, it should not be interpreted to be a commitment on the part of EventTracker, and EventTracker cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. EventTracker MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this paper may be freely distributed without permission from EventTracker, if its content is unaltered, nothing is added to the content and credit to EventTracker is provided. EventTracker may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from EventTracker, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. 2018 EventTracker Security LLC. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 1

Integrate Symantec Messaging Gateway Table of Contents Abstract . 1 Scope . 1 Audience . 1 Overview . 3 Prerequisites . 3 Integration of Symantec Messaging Gateway with EventTracker manager . 3 Configuring Log Delivery . 3 EventTracker Knowledge Pack. 4 Flex Reports . 4 Categories . 6 Knowledge Objects. 6 Import Symantec Messaging Gateway knowledge pack into EventTracker . 7 Category . 8 Knowledge Objects . 9 Parsing Rules . 10 Flex Reports . 12 Verify Symantec Messaging Gateway knowledge pack in EventTracker . 14 Categories . 14 Knowledge Objects . 14 Parsing Rules . 15 Flex Reports . 16 2

Integrate Symantec Messaging Gateway Overview Symantec Messaging Gateway delivers inbound and outbound messaging security, real-time antispam and antivirus protection, advanced content filtering, and data loss prevention in a single platform. EventTracker helps to monitor events from Symantec Messaging Gateway. It’s knowledge objects and flex reports will help you to analyze mail traffic and malicious email content and attachments. Prerequisites EventTracker v9.x or above should be installed. Symantec Messaging Gateway 10.x or above should be configured for forwarding logs. Please add exception for port 514 in firewall if exists in between Symantec Messaging Gateway and EventTracker Manager. Integration of Symantec Messaging Gateway with EventTracker manager Configuring Log Delivery To configure a Symantec Messaging Gateway to forward logs to a syslog server, In the Control Center, click Administration Settings Logs. Click the Remote tab. Click Enable Syslogs for the following host and click a host to send log data from that host to a remote syslog. In the Host field, specify the EventTracker Manager’s IP address. In the Port field, specify the port number 514. In the Protocol field, specify the syslog protocol: UDP. Click Enable message logs to send message logs to the remote syslog. Click Message log facility. Click Save to save your changes. To configure a log correlator for Symantec messaging gateway, 3 Run “smgintegrator.ps1” with admin privileges. Once the script has been executed successfully, verify the following:

Integrate Symantec Messaging Gateway o Open Run windows and type taskschd.msc. o On Task Scheduler window, check if SMG Log Correlator task has been created under Task Scheduler Library. Figure 1 EventTracker Knowledge Pack Once logs are received by EventTracker manager, knowledge packs can be configured into EventTracker. The following Knowledge Packs are available in EventTracker Enterprise to support Symantec Messaging Gateway. Flex Reports Symantec Messaging Gateway - Mail traffic – This report gives the information about the mail traffic which were delivered, dropped, quarantined etc. Figure 2 4

Integrate Symantec Messaging Gateway Sample logs: Figure 3 Symantec Messaging Gateway - Threat detected – This report gives the information about threats detected in mail or attachments by Symantec Messaging Gateway. Figure 4 5

Integrate Symantec Messaging Gateway Sample logs: Figure 5 Categories Symantec Messaging Gateway: Mail Traffic- This category provides information related to mail traffic which were delivered, dropped, quarantined or etc. based on the configured policy. Symantec Messaging Gateway: Threat Detected– This category provides information related to the threats detected in mail or attachments by Symantec Messaging Gateway. Knowledge Objects Symantec Messaging Gateway Mail Traffic– This knowledge object will help us to analyze logs related to Symantec Messaging Gateway’s mail traffic. Symantec Messaging Gateway Threat Detected – This knowledge object will help us to analyze logs related to the threats detected in mail or attachments by Symantec Messaging Gateway. 6

Integrate Symantec Messaging Gateway Import Symantec Messaging Gateway knowledge pack into EventTracker NOTE: Import knowledge pack items in the following sequence: Categories Knowledge Objects Parsing Rules Flex Reports 1. Launch EventTracker Control Panel. 2. Double click Export Import Utility. Figure 6 3. Click the Import tab. 7

Integrate Symantec Messaging Gateway Category 1. Click Category option, and then click the browse button. Figure 7 2. Locate Category Symantec Messaing Gateway. iscat file, and then click the Open button. 3. To import categories, click the Import button. EventTracker displays success message. 8

Integrate Symantec Messaging Gateway Figure 8 4. Click OK, and then click the Close button. Knowledge Objects 1. Click Knowledge objects under Admin option in the EventTracker manager page. 2. Locate the file named KO Symantec Messaging Gateway.etko. Figure 9 3. Now select all the check box and then click on 9 ‘Import’ option.

Integrate Symantec Messaging Gateway Figure 10 4. Knowledge objects are now imported successfully. Figure 11 Parsing Rules On EventTracker Control Panel, Click Token Value option, and then click the browse 10 button.

Integrate Symantec Messaging Gateway Figure 12 2. Locate Parsing rule Symantec Messaging Gateway.istoken file, and then click the Open button. 3. To import Parsing rule, click the Import button. 4. EventTracker displays success message. Figure 13 11

Integrate Symantec Messaging Gateway Flex Reports On EventTracker Control Panel, 1. Click Reports option, and select new (etcrx) from the option. Figure 14 2. Locate the file named Reports Symantec Messaging Gateway.etcrx, and select all the check box. 12

Integrate Symantec Messaging Gateway Figure 15 3. Click the Import button to import the reports. EventTracker displays success message. Figure 16 13

Integrate Symantec Messaging Gateway Verify Symantec Messaging Gateway knowledge pack in EventTracker Categories 1. Logon to EventTracker Enterprise. 2. Click Admin dropdown, and then click Categories. 3. In Category Tree to view imported categories, scroll down and expand Symantec Messaging Gateway group folder to view the imported categories. Figure 17 Knowledge Objects 1. In the EventTracker Enterprise web interface, click the Admin dropdown, and then click Knowledge Objects. 2. In the Knowledge Object tree, expand Symantec Messaging Gateway group folder to view the imported Knowledge objects. 14

Integrate Symantec Messaging Gateway Figure 18 Parsing Rules 1. In the EventTracker Enterprise web interface, click the Admin dropdown, and then click Parsing Rules. 2. In the Parsing Rule tab, select Symantec Messaging Gateway group folder to view the imported parsing rules. Figure 19 15

Integrate Symantec Messaging Gateway Flex Reports 1. In the EventTracker Enterprise web interface, click the Reports icon, and then select Report Configuration. Figure 20 2. In Reports Configuration pane, select Defined option. 3. Click on the Symantec Messaging Gateway group folder to view the imported Symantec Messaging Gateway reports. Figure 21 16

Integrate Symantec Messaging Gateway Verify Symantec Messaging Gateway knowledge pack in EventTracker Categories 1. Logon to EventTracker Enterprise. 2. Click Admin dropdown, and then click Categories. 3. In Category Tree to view imported categories, scroll down and expand Symantec Messaging Gateway group folder to view the imported categories.