10827 rsa envision supported event sources

11
Created on September 14, 2011. Table of Contents l RSA Supported Event Sources l Partner Created Event Sources RSA Supported Event Sources The following is an alphabetical list of supported event sources sorted by partner name that are available in the monthly Content Event Source Updates (ESUs). Contact RSA Customer Support for the latest status and details of the integration. If you are unable to find your event source from our list of supported event sources, visit http://www.rsa.com/go/partners/suggest_ new.asp . A B C D E F G H I J K L M N O P Q R S T V W A Vendor Device Collection Method Actividentity 4TRESS AAA Server - version 6.4.1 ODBC Airmagnet AirMagnet Enterprise - version 7.5.0, 8.5 Syslog Alcatel- Lucent OmniSwitch - versions 6850 & 9700 Syslog, SNMP Apache HTTP Server - versions 2.1, 2.2 Log File FTP Apache Tomcat Server - version 6.0 File Reader Apple Mac OS X - version 10.4.3 Build 8F46 Syslog Application Security DbProtect - version 6.0 ODBC Arbor Networks Peakflow SP5 - version 5.0 Syslog Arbor Networks Peakflow X - version 4.1 Syslog Aruba Networks Aruba Networks Mobility Controller - version ArubaOS 2.5.4.0, 3.4 Syslog Astaro Security Gateway - version 7.x Syslog Avocent Avocent IP KVM - version Dell PowerEdge 2161DS-2 SNMP - parser trap handler B Vendor Device Collection Method Barracuda Networks Spam Firewall - version 3.4 & 3.5 Syslog Barracuda Networks Web Application Firewall - firmware version 7.4.0 Syslog BigFix BigFix Enterprise Suite - version 7.2 ODBC Blue Coat Systems CacheOS (CacheFlow Appliance) - versions 4.1, 4.2, 5.1, 5.2, 5.3, 5.4, 5.4.1.12 Log File FTP Copyright © 2010 EMC Corporation. All Rights Reserved.

Upload: saad-ahmed

Post on 01-Dec-2014

517 views

Category:

Documents


6 download

TRANSCRIPT

Page 1: 10827 RSA EnVision Supported Event Sources

Created on September 14, 2011.

Table of Contentsl RSA Supported Event Sources

l Partner Created Event Sources

RSA Supported Event SourcesThe following is an alphabetical list of supported event sources sorted by partner name that are available in the monthly ContentEvent Source Updates (ESUs). Contact RSA Customer Support for the latest status and details of the integration. If you areunable to find your event source from our list of supported event sources, visit http://www.rsa.com/go/partners/suggest_new.asp.

A B C D E F G H I J K L M N O P Q R S T V WA

Vendor Device Collection MethodActividentity 4TRESSAAAServer - version 6.4.1 ODBC

Airmagnet AirMagnet Enterprise - version 7.5.0, 8.5 Syslog

Alcatel-Lucent OmniSwitch - versions 6850 & 9700 Syslog, SNMP

Apache HTTPServer - versions 2.1, 2.2 Log File FTP

Apache Tomcat Server - version 6.0 File Reader

Apple MacOSX - version 10.4.3 Build 8F46 Syslog

Application Security DbProtect - version 6.0 ODBC

Arbor Networks Peakflow SP5 - version 5.0 Syslog

Arbor Networks Peakflow X - version 4.1 Syslog

Aruba Networks Aruba NetworksMobilityController - version ArubaOS 2.5.4.0, 3.4 Syslog

Astaro SecurityGateway - version 7.x Syslog

Avocent Avocent IP KVM - version Dell PowerEdge 2161DS-2 SNMP - parser trap handler

BVendor Device Collection Method

Barracuda Networks Spam Firewall - version 3.4 & 3.5 Syslog

Barracuda Networks Web Application Firewall - firmware version 7.4.0 Syslog

BigFix BigFixEnterprise Suite - version 7.2 ODBC

Blue Coat Systems CacheOS (CacheFlow Appliance) - versions 4.1, 4.2, 5.1, 5.2, 5.3, 5.4, 5.4.1.12 Log File FTP

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 2: 10827 RSA EnVision Supported Event Sources

Vendor Device Collection MethodBlue Coat Systems ProxySGSGOS (SecurityGatewayAppliance) - versions 4.1, 4.2, 4.3, 5.1, 5.2, 5.3, 5.4, 5.4.2,

5.4.3.2, 5.4.3.7, 5.4.6.1, 5.5.1.1, 5.5.5.1, 6.1.1.1, and 6.1.3.1Log File FTP

Brocade FastIron Switch - version FGS624P- STK Syslog

CVendor Device Collection Method

CA ACF2 ZOS - version 1.4 Log File FTP

CA Integrated Threat Management - version r8, 8.1 SNMP

CA SiteMinder - version r12 File Reader

CA Top Secret - version 1.4 Log File FTP

CheckPoint CheckPoint SecuritySuite, IPS-1- versions R54 - R65, R70, R71, R75 CheckPoint LEAAPI

CheckPoint IPSO - version 3.5 and earlier, 3.6, 3.7, 3.8, 3.9, 6.2 Syslog, SNMP

CheckPoint SPLAT OS - R75 Syslog

CipherTrust CipherTrust IronMail - version 5.5 SNMP

Cisco AccessControl Server - versions 3.3, 4.0, 4.2 (software only)

AccessControl Server - versions 4.0, 4.1, 4.2, 5.1, 5.2(appliance)

Log File FTP, Syslog

Cisco Nexusversion 1000V Syslog

Cisco Secure AccessControl Server - versions 4.0, 4.1, 4.2, 5.1, 5.2 Log File FTP, Syslog

Cisco Secure AccessControl Server Express - version 5.0 Syslog

Cisco Adaptive SecurityAppliance Software - versions 7.1(2), 7.2, 8.0, 8.2, 8.4 (to generate syslogevents)

ASASecurityServicesModule Software - version 5.1(1p1) (to generate IDS events)

Syslog

Cisco Aggregation ServicesRouter version 3.3 Syslog

Cisco Aironet AP (WirelessAccessPoint) - version IOS 12.2 Syslog

Cisco Application Control Engine - version 4710 Syslog

Cisco Catalyst Switch 6500 CATOS , Cisco IOS12.4- version 8.3 (alerting only) Syslog (CATOS&Cisco IOS),SNMP (Cisco IOS)

Cisco CiscoWorksNetworkComplianceManager - version 1.4 SP2 ODBC

Cisco Content Engine - versions 5.0, 5.4, 5.5 Log File FTP, Syslog

Cisco Content ServicesSwitch - versions 5.10, 8.10 Syslog

Cisco Firewall ServiceModule - version 4.1(5) Syslog

Cisco IdentityServicesEngine version 1.0 Syslog

Cisco IronPort Email SecurityAppliance - versions 5.7.0, 7.1.3 Log File FTP

Cisco IronPortWeb SecurityAppliance - version 5.7.0, 6.3, 7.1.1 Log File FTP

Cisco LAN Management Solution - version 3.2 and 4.0 File ReaderCisco Monitoring, Analysis, and Response System (MARS) - version 6.0.3, 6.0.7, 6.0.8, 6.1. Syslog, File Reader

Cisco MobilityServicesEngine - versions 5.2.91.0, 6.0.97.0, 7.0.105.0 Syslog

Cisco NetworkAdmission Control - version 4.7 Syslog

Cisco PIX Firewall - version 7.0, 8.0 Syslog

Cisco Router - version IOS 12.4, 15 Syslog, SNMP

Cisco Secure IDS/IPS - versions 4.x, 5.0, 5.1, 6.0, 6.1, 6.2, 7.0 SDEE, RDEP (prior to enVision4.0)

Cisco SecurityAgent - versions 4.0, 5.1, 6.0 SNMP,ODBC

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 3: 10827 RSA EnVision Supported Event Sources

Vendor Device Collection MethodCisco SecurityManager (also branded asCiscoWorksCommon Services) - version 2.3, 3.0, 3.3, 4.0 File Reader, Syslog File Reader

Cisco Unified Computing SystemManager - version 1.0 (2d) Syslog

Cisco VirtualSecurityGatewayversion 4.2(1)VSG(1) Syslog

Cisco VPN 3000 Concentrator - versions 3.6.7 , 4.0, 4.1, 4.7 Syslog

Cisco WirelessControl System - version 7.0 SNMP

Cisco WirelessLAN Controller (WLC) - versions 5.2.157.0, 6.0.188, 7.0.98.0 Syslog

Citrix AccessGateway - version 4.5 and 4.6 Syslog

Citrix NetScaler - versions 9.1, 9.2 Syslog

Citrix XenApp - version 5 for Windows Server 2003 ODBC

CrossbeamSystems C-Series - versions 4.X, 5.X, 6.X Syslog

Cyber-Ark Enterprise Password Vault, Inter-BusinessVault, and Sensitive Document Vault - version 5.0 Syslog

CyberGuard Firewall TSPFamilySeries - version 6.4.1 Syslog

CyberGuard Cyberguard Classic - version 5.2 P4 Syslog

DVendor Device Collection Method

Debian DebianGNU/Linux - versions 3.1 and 4.0 Syslog

Dell DRAC (DellRemote AccessController) -version 6.0 SNMP

Dell PowerConnect 5324 Switch - version 1.0.0.47 Syslog

EVendor Device Collection Method

eEye BlinkEndpoint Protection - version 4.6 SNMP

eEye REMSecurityManagement Console - version 3.7 SNMP

eEye Retina NetworkSecurityScanner - version 5.10 Syslog, SNMP

EMC Avamar - version 4.1 ODBC

EMC Celerra - version 5.5, 5.6(branded as: EMC Control Station, Blades, DataMover)

SNMP, NIC WindowsService

EMC Clariion / VNX - version Navisphere 6.28 and Unisphere 1.1 SNMP

EMC Data Protection Advisor - version 5.6 ODBC

EMC FabricOS - version 6.1, 6.2 Syslog

EMC GreenplumDatabase - version 4.0 File Reader

EMC IonixSCM (Server ConfigurationManager) - version 5.2 AgentlessWindows

EMC IonixUnified InfrastructureManager (UIM) - version 1.0 and 2.1 ODBC and Syslog

EMC SymmetrixSolutionsEnabler - version 6.4, 6.5.3, 7.0, 7.1, and 7.3.0.1

SymmetrixV-Max

Syslog, NIC WindowsService

EMC Voyence - version 4.0.1 SNMP

EMC VPLEX File Reader

EMC Documentum - version 6.5 and 6.7 ODBC

Enterprise IT-Security SF-NoEvasion - version 7.1 Syslog

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 4: 10827 RSA EnVision Supported Event Sources

Vendor Device Collection MethodEnterasysNetworks Dragon - version 5.x, 6.x, 7.2, 7.4 SNMP

EnterasysNetworks Switch - N-Series and S-Series Syslog

ExtremeNetworks ExtremeWare Switch - version 6.2, 7.2, 7.7 Syslog

Extreme Networks ExtremeXOS - version 12.2.1.1 Syslog

FVendor Device Collection Method

F-Secure F-Secure Anti-Virus for WindowsServers, F-Secure Client Security, F-Secure LinuxSecurity Syslog,Windowsevent logs

F5 BigIP Local TrafficManager - version 9.4, 10.2.0 Syslog

F5 BigIPAccessPolicyManager - version 10.2.0 Syslog

F5 BigIPApplication SecurityManager version 10.2.0 Syslog

F5 F5 Firepass - version 5.5-20051019 Syslog

FairWarning PrivacyMonitoring version 2.9.2 SFTP

Fortinet FortiGate AntivirusFirewall, running FortiOS - version 2.8, 3.0, 4.0 MR1, 4.0 MR2 Syslog

Fortinet FotiClient Endpoint Security - version 4.2.3.271 Syslog

Fortinet FortiMail - version 4.0 Syslog

FoundryNetworks Switch - version 07 Syslog

FreeBSD FreeBSD - version 5.4 Syslog

GVendor Device Collection Method

GEHealthcare GECentricityPACS-IW - version 3.7.3 ODBC

GIT GIT version 1.7.6 File ReaderGlobalScape EFT Server all versions up to 6.3.8 File Reader

Guardium SQLGuard Syslog

HVendor Device Collection Method

HP IntegrityNonStop Server - all versions Syslog

HP Open VMS - all versions Log file FTP

HP ProCurve Switch series 2600, 2800, 5300 Syslog

HP UX - version 11.X, C2 v11.X Syslog

HyTrust HyTrust Appliance - version 2.0.10264 Syslog

IVendor Device Collection Method

IBM AIX 5L (Security and Authenticationmessagesonly), 6.1, 7.1 Syslog, Syslog NG

IBM iSeriesAS400 - V5R2 and later Log File FTP

IBM (Lotus) LotusDomino - versions 7, 8, 8.5 SNMP

IBM DB2UDB - versions 7, 8, 8.1, 9.1, 9.5, 9.7 Log File FTP

IBM Mainframe ICSF - all versions Log File FTP

IBM Mainframe IDMS - all versions Log File FTP

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 5: 10827 RSA EnVision Supported Event Sources

Vendor Device Collection MethodIBM Mainframe IMS - all versions Log File FTP

IBM Mainframe SMA_RT OS390/ZOS - version 2.0.6 Syslog

IBM MainframeRACF ZOS - version 1.4 Log File FTP

IBM ISSProduct suite: Proventia Appliance, SiteProtector, Internet Scanner, RealSecure - SiteProtector v2.0 SP6.1, SP7.0, SP8.0

ODBC

IBM Mainframe Top Secret ZOX - version 1.4 Log File FTP

IBM Tivoli AccessManager for Enterprise Single Sign-On - version 8.0.1 ODBC

IBM Tivoli AccessManager WebSEAL - version 6.0 SFTPAgent, File Reader(Windows)

IBM Tivoli IdentityManager - version 5.1 ODBC

IBM Websphere - version 6.0.0.1/Microsoft Windows 2003,

Websphereversion 7.0.0.9/Redhat Linux/Solaris/IBM AIX 6.0

File Reader

IBM Websphere DataPower- version 3.8.1 Syslog

IBM WebsphereMQ- version 7.0.1 File Reader

Imperva SecureSphere - versions 6, 7, 8 Syslog

Infoblox NIOS - version 5.1 for Linux Syslog

Intel NetStructure VPN - version 6.9 Syslog

Intersect Alliance Snare for Linux - version 1.5.1 Syslog

Ipswitch WhatsUpGold - version 14.2 ODBC

JVendor Device Collection Method

Juniper Networks DXApplication Accelerator - version 5.1.5 Syslog

Juniper Networks IDP - versions 3.0, 3.1, 3.2, 4.0, 4.1, 5.0 Syslog

Juniper Networks Infranet Controller 4500 - version 2.2 and 3.1 Syslog

Juniper Networks JUNOSRouter - version 6.1, JUNOS 9.4, 9.6, 10.0, 10.3, SRXSeries Syslog

Juniper Networks NetScreen Firewall ScreenOS - versions 5.1, 5.3, 5.4, 6.0 Syslog

Juniper Networks NetScreen ScreenOS versions 5.1, 5.3, 5.4, 6.0, 6.1, 6.2 Syslog

Juniper Networks NetScreen-SecurityManager - versions 2004, 2006, 2007, and 2010 Syslog

Juniper Networks SSL VPN - versions 5.4, 5.5, 6.0, 6.2 R2, 6.5 R2, 7.0 R2 Syslog

Juniper Networks Steel-Belted Radius - version 5.4 and 6.1.6 Log File FTP

KVendor Device Collection Method

Kasperksy Anti-Virus - Kaspersky Business Space Security, Kaspersky Enterprise Space Securityand Kaspersky Total Space Security,Kaspersky Anti-Virus 6.0 for Windows Workstations/Windows Server,Kaspersky Security version 5.5 for Microsoft Exchange Server,Kaspersky Administration Kit 8.0, Kaspersky Anti-Virus for Microsoft ISA Server 2004Enterprise Edition and 2006 Enterprise Edition.

ODBC

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 6: 10827 RSA EnVision Supported Event Sources

LVendor Device Collection Method

Lancope StealthWatch - versions 5.5, 5.6, 5.9, 5.10, 6.0(StealthWatch Xe for NetFlow, StealthWatch Xe for sFlow, StealthWatch NC)

Syslog

Lumension Endpoint Management and SecuritySuite - version 7.0 ODBC

MVendor Device Collection Method

ManageEngine Netflow Analyzer - version 8.0 ODBC

MazuNetworks Mazu Profiler - versions 5.5.2, 6.0, 7.0 SNMP

McAfee Endpoint Encryption - version 5.2.2 SFTPAgent, File Reader

McAfee ePolicyOrchestrator - versions 3.5, 3.6.0, 3.6.1, 4.0, and 4.5

Note: enVision 3.7 and later required for version 4.0 and 4.5.

ODBC

McAfee Firewall Enterprise - versions 6.1.1.x, 6.1.2.x, 7.0.0.x, 8.0 Syslog

McAfee VulnerabilityManager (formerly known asFoundscan Professional/Enterprise) - versions 5.0,6.5.1, 6.8, 7.0

ODBC

McAfee Host Data LossPrevention - versions 2.2, 3.0 ODBC

McAfee Host Intrusion Prevention (also branded asEntercept):

l version 6.0.1 supported on McAfee ePolicy Orchestrator version 3.6l version 7.0 supported on McAfee ePolicy Orchestrator version 4.0

ODBC

McAfee IntegrityControlversions 5.0.2 and 5.1.0 ODBC

McAfee Intrushield - versions 2.1, 3.1, 4.1, 5.1, 6.1 (only for Syslog messages) Syslog

McAfee NetworkAccessControl - version 3.1.1 ODBCMcAfee NetworkData LossPrevention - version 8.6 ODBCMcAfee PolicyAuditor - version 5.2 ODBC

McAfee VirusScan Enterprise - version 8.0i, 8.5i, 8.7i WindowsEvent Logs, ODBC

McAfee WebGateway - version 6.8.5, 7.0 Log File SFTP

McKesson Horizon Patient Folder - version 15 ODBC

Microsoft Audit Collection Service - version 2007 SP1 ODBC

Microsoft DHCPServer,Windows 2000,Windows 2003, Windows 2008 Log File SFTP

Microsoft Endpoint Protection 2010 ODBC

Microsoft Exchange Server - versions 2003, 2007, and 2010 Log File FTP,WindowsEventLogs

Microsoft Forefront Client Securityversion 1.1 ODBC

Microsoft Forefront Threat Management Gateway - version Beta, ISA 2006, TMG 2010 File Reader, SFTPAgent,ODBC

Microsoft Forefront Unified AccessGateway - version 2010 Syslog or ODBC

Microsoft Internet Authentication Service version 2003 Log File FTP,WindowsEventLogs

Microsoft Internet Information Services (IIS) - versions 5.x, 6.x, 7.x File Reader

Microsoft Internet Security and Acceleration (ISA) Server - versions 2000, 2004, 2006 Log File FTP,WindowsEventLogs

Microsoft NetworkAccessProtection - version 1.1 ODBC

Microsoft SharePoint Server - versions 2007 and 2010 AgentlessWindows

Microsoft SystemCenter OperationsManager - version 2005, 2007 AgentlessWindows

Microsoft SystemCenter ConfigurationManager - version 2007 AgentlessWindows

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 7: 10827 RSA EnVision Supported Event Sources

Vendor Device Collection MethodMicrosoft SQL Server - version 2000, 2005, and 2008 ODBC, Log File FTP,Windows

Event Logs

Microsoft Windows (agentless) Microsoft Event Logging API

Microsoft Windows (via third party collection agent) - Adiscon Event Reporter &DNSServer Syslog via Agent

Microsoft Windows (via third party collection agent) - InterSect-Alliance BackLog Syslog via Agent

Microsoft Windows (via third party collection agent) - InterSect Alliance SNARE Syslog via Agent

Microsoft WindowsServer Update Service ODBC

Motorola AirDefense Enterprise Server - version 7.2, 7.3 Syslog

MySQL MySQLEnterprise - version 5.1 SNMP

NVendor Device Collection Method

nCircle Configuration ComplianceManager version 5.10 SyslognCircle nCircle IP360 - versions 5.5, 6.5, 6.8 XML3NETASQ UnifiedManager - version 8.1.3 Syslog

NetContinuum NetContinuumWeb Application Firewall - version NC OS 5.x Syslog

NetWitness NextGen - version 9 Syslog

NetworkAppliance Data ONTAP - version 6.x through 7.3.1.1 Syslog

NetworkAppliance NetCache - version 5.5R3, 5.6.2R1, 6.03, 6.1 Log File FTP

Open Source NFDump - netflow v5, v7, v9 / NFDump v1.5.7 Log File SFTP

NFR NIDS - version 3.x, 4.x, 5.x Syslog

Nortel Alteon Switch Firewall - version 8.x Syslog

Nortel ContivityVPN Switch Syslog

Nortel Passport 8600 Routing Switch - version 3.7.5.2

(rebranded to Ethernet Routing Switch 8600)

Syslog

Novell eDirectory - version 8.8 for Windowsand Linux SNMP

Novell SuSELinux - version 9, 10, 10.2, 11 Syslog

OVendor Device Collection Method

Open Source NFDump - netflow v5, v7, and v9 Log File SFTP

Open Source SNORT - version 2.8 (signature level 1.41.2.14) Syslog

Open Source Squid - versions 2.5.9, 2.7, and 3.0 File Reader

Oracle Database - versions 8i, 9i, 10g, 11g ODBC, Log File FTP, Syslog

Oracle Internet Directory - version 10.1 ODBC

Oracle IdentityManager - version 9.1 ODBC

Oracle iPlanetWeb Server version 6.1 and 7 File Reader, SFTP

Oracle Database Vault - version 10g R2 File Reader, SFTP

Oracle OracleWebLogic - version 10.0, 10.3, 10.3.2, and 10.3.5 File Reader, SFTP

PVendor Device Collection Method

Palo Alto NetworksFirewall - version 4000 SyslogPerforce Perforce File Reader

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 8: 10827 RSA EnVision Supported Event Sources

QVendor Device Collection Method

Qualys QualysGuard- versions 6.5, and 6.6 HTTPS

RVendor Device Collection Method

Radware Radware DefensePro - version 5.01.02 Syslog, SNMP

Rapid 7 NeXpose - version 4.8 File ReaderResearch inMotion BlackBerryEnterprise Server - version 5.0 FileReader

Red Hat Red Hat Enterprise Linux3.x, 4.x, 5.x, and 6.0 Syslog

RSASecurity AccessManager - version 6.0 on Solaris, Windows, and Linux Log File SFTP

RSASecurity Adaptive Authentication (Hosted) - versions 8.8, 8.9, 9.0, 9.1 SFTPAgent, File Reader

RSASecurity Adaptive Authentication (OnPrem) - version 6.0.2.1 Syslog

RSASecurity AuthenticationManager and User CredentialManager - versions 5.2, 6.0, 6.1, 7.1 SP2, 7.1 SP4 Log File FTP

Syslog for RSAAuthenticationManager 7.1 and later

RSASecurity CertificateManager - version 6.8 SFTPAgent, File ReaderRSASecurity Data LossPrevention - version 7.0.0, 8.0, 8.0 SP1, and 8.5 Syslog

RSASecurity Federated IdentityManger - version 4.1 File ReaderRSASecurity KeyManager - versions 2.1.3, 2.5, 2.7 Syslog

RSASecurity Virtual Log Router version 1.1 Syslog

SVendor Device Collection Method

Safend Protector - version 3.3 Syslog

Safestone DetectIT version 14.3 Syslog

SAP SAPERPCentralComponent - version 4.6 through 7.2 File Reader

SECUDE Security Intelligence - version 1.0 File Reader

Sourcefire SNORT 2.8 (signature level 1.41.2.14)

Sourcefire Defense Center 4.6, 4.8. and 4.9

Sourcefire eStreamer 4.9

Syslog

Solsoft NP - version 5.2.4 Syslog

SonicWALL E-ClassSRA / Aventail SSL VPN - version 8.8, 9.0, 10.0 Log File FTP, Syslog

SonicWALL Email Security - version 7.2 Syslog

SonicWALL Firewall (alerting only) Syslog

SonicWALL GlobalManagement System - version 6.0 ODBC

Sophos Endpoint Security - version 4.5

Enterprise Console - version 3.0

SNMP,ODBC

Sun Solaris - versions 2.8, 2.9, 2.10 Syslog

Sun SolarisBasicSecurityModule (BSM) - versions 8, 9, 10, 11 Log File FTP and Syslog

Sun SunONE DirectoryServer - version 5.2 File Reader

Sourcefire Sourcefire - versions 4.6, 4.8, 4.9 Syslog

Sybase Sybase Adaptive Server Enterprise - version 15 ODBC

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 9: 10827 RSA EnVision Supported Event Sources

Vendor Device Collection MethodSymantec Critical SystemsProtection - version 5.2.4 ODBC

Symantec Data LossPrevention - version 10.5.1 Syslog

Symantec Endpoint Protection - versions 9.0, 10.0, 10.1, 10.2, 11, 11.0.5 SNMP, Syslog, ODBC

Symantec Enterprise Firewall - versions 6.x, 7.x, 8.x SNMP

Symantec Intruder Alert - version 3.6 SNMP

Symantec NetworkSecurity - version 4.0 Syslog

TVendor Device Collection Method

Tenable Nessus - versions 4.4, 4.2, 4.0.1, 3.0.6, 1.0.2 File Transfer

TippingPoint SecurityManagement System (SMS) - versions 2.1, 2.5, 2.6, 2.7, 3.0, 3.1 Syslog

Top Layer AttackMitigator - version 2.1 Syslog

Top Layer Secure Edge Controller - version 2.01 Syslog

TrendMicro Deep Security - version 7.0 and 7.5 Syslog

TrendMicro InterScanMessaging SecuritySuite - version 7.1 SNMP, File Reader

TrendMicro InterScanWeb SecuritySuite - version 3.1 ODBC, File Reader

TrendMicro OfficeScan Corporate Edition - version 7.0, 8.0, 10.0, and 10.5ControlManager - version 3.5, 5.0

SNMP, Syslog

TrendMicro OSSEC version 2.5.1 Syslog

TrendMicro ScanMail - ScanMail 8.0 Service Pack1 for Microsoft Exchange 2000, 2003, 2007 SNMP

Tripwire Tripwire Enterprise - versions 5.4, 5.5, 7.5, 8.0 Log File FTP, Syslog (forversion 8.0)

VVendor Device Collection Method

Varonis DatAdvantage - version 5.5 ODBC

VMware vCloud Director- version 1.0 Syslog

VMware VMware VirtualCenter server- versions 2.0.2 and 2.5

VMware vCenter Server version 4.1VMware ESX - versions 3.0.3, 3.5, 4.0, 4.1VMware ESXi - versions 3.5, 4.0, 4.1VMware Embedded ESXi - versions 3.5 and 4.0

Syslog

VMware vShield version 4.1 Syslog

VMware VMware View - versions 3.1, 4.0, 4.5, 4.6 SFTPAgent, File Reader,ODBC

WVendor Device Collection Method

WebSense Web Security - versions 5.5, 6.3, 7.0, 7.1, 7.5 SNMP

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 10: 10827 RSA EnVision Supported Event Sources

Partner Created Event SourcesThe following is an alphabetical list of partner created device support in collaboration with the RSA Secured® TechnologyPartner Program. The RSA Secured Technology Partner Program for RSA enVision combines the best-in-class partnerframework of RSA’s Technology Partner Program with the RSA enVision EventSource Integrator (ESI) tool to allow devicemanufacturers the ability to create their own event support. The partner created content will be subject to review andcertification by RSA. On successful certification, the content will be available for download from the RSA enVisionIntelligence Community at https://rsaenvision.lithium.com/.

A C F J L M N R SA

Vendor Device Collection MethodAirTight Networks SpectraGuard Enterprise - version 6.5 Syslog

ArrayNetworks SPXSeriesUniversalAccessControllers - version 8.4.6 Syslog

CVendor Device Collection Method

CoreTrace Bouncer - version 6.1 Syslog

FVendor Device Collection Method

FireEye Malware Protection System (MPS) - versions 5.1.0 & 5.2.0 Syslog

FoxT Server Control - version 6.5 Syslog

JVendor Device Collection Method

Juniper Networks Altor NetworksSecuritySuite - version 4.0 Syslog

LVendor Device Collection Method

Lieberman Software Enterprise RandomPasswordManager - version 4.83.1 Syslog

MVendor Device Collection Method

M86Security SecureWebGateway - version 10.1 Syslog

NVendor Device Collection Method

NetClarity NACwall - version 8.0.6 Syslog

RVendor Device Collection Method

Raz-Lee iSecurity for IBM-I - version 11.4 Syslog

Copyright © 2010 EMC Corporation. All Rights Reserved.

Page 11: 10827 RSA EnVision Supported Event Sources

SVendor Device Collection Method

Stonesoft StoneGateManagement Center - version 5.3 Syslog

Copyright © 2010 EMC Corporation. All Rights Reserved.