How to install and configure Sidewinder Collector 4.2 for onboard collection

Products

• Security Information Manager

Issue/Introduction

 

Resolution

Download the Sidewinder_G2_Event_Collector_4.2.4_AllWin_AllLinux_EN.zip file from fileconnect (https://fileconnect.symantec.com)

The archive contains the  update-sidewindercollector.jar file which is used to install the collector onboard.

1. Logon to Web-UI of the SSIM appliance on which you want to install the collector.

On 4.7: Go to Maintenance -> System Updates -> Install

              Click on the Browse button and select the update-sidewindercollector.jar  file and then click on Upload and Install

On 4.6: Go to System Updates -> Install

              Click on the Browse button and select the update-sidewindercollector.jar  file and then click on Upload and Install

 

2. Once the installation is finished you will have to logon to the SSIM Client and go to

System->Product Configurations and create a new configuration for the Sidewinder G2 Event Collector.

Make sure when prompted for the Computer to add the appliance where you installed the collector.

 

 

3. When the configuration  has been created go to the Sensor setting and edit the settings of your sensor. Make sure to change the port from 514 to 10546.

 

 

4.  Once this has been done you will have to go to the Syslog Director configuration of the appliance where the collector is installed and edit the Director Settings. Open the Advanced Options on this page and Click on Add.

 

5. When prompted add the signature like it is mentioned in the documentation.

 

6. The last step is to move up the Collector in the list with the signatures and to enable the port redirection.

The end result should be similar to the below one.