Adding an SIEM Server

To add an SIEM Security Incident and Event Management (SIEM) is a server where Aruba IDPS sends the threat data to perform advanced analysis and generate reports. SIEM provides a holistic picture of the security posture by aggregating and correlating data from disparate sources in the network. for IDPS Intrusion Detection and Prevention System (IDPS) monitors, detects, and prevents threats in the inbound and outbound traffic. Aruba IDPS provides an extra layer of protection that actively analyzes the network and takes actions on the traffic flows based on the defined rules. It inspects data packets, and if any threat is identified, acts real-time to prevent it., complete the following steps:

1. In the WebUI, set the filter to Global.
   The dashboard context for all devices is displayed.
2. Under Manage, click Security > Gateway IDS/IPS.
3. Click the Config icon to open the Gateway IDS/IPS configuration page.
4. Click the SIEM tab.
5. Click + in the Servers table.
6. In the Add SIEM Server window, enter the following details:
   • Name—The name for the server.
   • URL—The SIEM server URL Uniform Resource Locator. URL is a global address used for locating web resources on the Internet.. Specify the TCP Transmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. port number after the colon (:8088 or :443), as the last element of the URL. The port number must not be followed by anything else like the services, collector, or event details. For example, https://prd-p-op170.splunkcloud.com:8088. For more information, see Supported URL Formats.
   • Index—The index from the third-party SIEM provider to contain the threat data.
   • Token—The authentication token from the third-party SIEM provider to connect to the server.
7. Click Test Connection to verify if the connection to the SIEM server is working.
8. Click Add.

Supported URL Formats

The following are the URL formats that are accepted for the IDPS SIEM server configuration.