ObserveIT_RSA Security Analytics

[Anonymous]

Hi All,

last week I got a document which addresses ObserveIT logs collection is possible in RSA security Analytics environment, is it correct?

Because there is no official announcement from RSA.

[RSAAdmin]

Please consider moving this question as-is (no need to recreate) to the proper forum for maximum visibility.  Questions written to the users' own "Discussions" space don't get the same amount of attention and can go unanswered for a long time.

You can do so by selecting "Move" under ACTIONS along the upper-right.  Then search for and select: "RSA Security Analytics".

[Anonymous · Accepted solution]

Agree with Chris above, but I'll go ahead and answer the question.

The link I provided last week should have had two files associated with the post (on the left side of the page).

https://community.emc.com/docs/DOC-31072

ObserveIT_5.5_SA10.2.pdf -- this Implementation Guide how to configure the product to send syslog to SA.

observeitpe.zip -- which is the SA integration package deployed on your log decoder.

Also, if you want to find all the RSA partner created content, search for "partner_created_content" (without the quotes) in the RSA Security Analytics EMC group.  There should be approximately 23  integrations so far.

- John