3.1 Configuring Sentinel as a Sender
If Sentinel is the sender, you must import and configure the Sentinel Link Integrator plug-in and the Sentinel Link Action plug-in to create a Sentinel Link configuration. You also need to create an action that forwards the selected events to the receiver. To filter the events, use the Correlation Manager to set a correlation rule. Associate the action to the rule and deploy it. You can also use Global Filters to filter the events and forward them to the receiver.
NOTE:For more information on Sentinel Link Integrator and Action, see the corresponding plug-in documentation in the NetIQ Sentinel Plug-ins Web site.
Perform the following instructions to configure Sentinel server to send the events:
3.1.3 Automatically Forwarding Events to the Receiver
To select events that you want to automatically forward to a receiver, you need a filtering mechanism. Use Correlation rules or Global Filters to filter the desired events, and associate the Sentinel Link Action to forward to the receiver.
NOTE:To forward events to another Sentinel server based on simple filtering conditions, use Sentinel Link with Global Filters.
You can also use Sentinel Link anywhere in Sentinel to execute a javascript action, such as Correlation, Incidents, and Event right-click. Be aware that these mechanisms can forward the same event more than once. Use them only when simple filtering conditions are not enough.
For example, using Correlation, you can configure filter(1=1) and filter(e.sev>=3), and launch Sentinel Link action to forward the events to the same receiver. When you trigger the action, the receiver gets duplicated events.
Note that some field values of the events change during event forwarding. For example, the event id changes, but, the event name remains the same when you forward an event.
Another advantage of Global Filters over Correlation rule is that the events are sent in batches of 500 events to the receiver system. With Correlation rule, each event is forwarded to the receiver as soon as an event is generated.
Using Correlation Rules to Forward Events to the Receiver
You can create Correlation rules that filter the desired events for forwarding to the receiver system. After creating a rule, associate the Sentinel Link Action while deploying the rule.
This section describes how to use Correlation rules to forward events to the receiver in a Sentinel system.
The following example illustrates creating a simple rule that forward events with severity greater than 3.
-
Log in to the Sentinel Web interface as a user with the Manage Correlation Engine and Rules permission.
-
In the navigation panel, click .
-
Click .
-
In the Subrule window, click .
-
Select the criteria to set it to Severity>3, then click.
The specified criteria are displayed in the Subrule window.
-
To associate one or more actions to the rule, in the Actions panel, click
.
-
Select action.
-
Click .
-
Click .
-
Specify an intuitive name, for example, for the rule and an optional description, then click .
-
Double-click the rule that you want to deploy.
-
In the Deploy/Undeploy section, select the engine to which you want to deploy the rule, then click .
NOTE:You can also deploy a rule from the Correlation dashboard. In the Correlation panel, click the engine to which you want to deploy rules. In the Available rules section, select the rule or rules that you want to deploy, then click .
Using Global Filters to Forward Events to the Receiver
You can use Global Filters to filter the desired events for forwarding to the receiver system.
This section describes how to use Global Filters to forward events to the receiver in a Sentinel system.
You must configure and activate the rule to forward events to another Sentinel system.
Configuring the Rule to Forward Events to the Receiver
Sentinel is installed with a rule, that forwards events to another Sentinel server. By default, the rule is configured to filter out internal system events and events with severity greater than three. This rule filters the following three types of system events:
-
Audit (A)
-
Performance (P)
-
Internal (I)
You can also change the conditions of the rule to filter more events or remove conditions to filter fewer events.
NetIQ recommends that you configure the rule to forward only those events that you want to store on the Sentinel server for more in-depth reporting and analysis.
Activating the Rule to Forward Events to the Receiver
The rule is installed with Sentinel, but it is in the inactive (off) state. You must activate the rule to forward the events to another Sentinel system.
To activate the rule to forward events to the receiver:
-
Log in to the Sentinel Web UI as an administrator.
-
Click in the toolbar.
-
Click link next to the rule.
-
Select from the list.
-
Click .
-
Select the check box adjacent to the rule.