Configure trusted connections between SIEM and PTA

You must configure trusted connections to send secured syslog data between SIEM and PTA.

Configure SIEM trusted connection to PTA

Secured syslog data requires that a third-party certificate is installed on your PTA Server machine, and that a client certificate is installed on your SIEM machine.

  1. Follow the instructions in Import your Organization's SSL Certificate to create the Server Certificate.
  2. Upload the Base-64 Cer Server Certificate file to the appropriate location in each SIEM solution.
  3. Configure each SIEM solution to send secured syslog data to PTA using the Server Certificate.
  4. Upload each SIEM client certificate to PTA. To do this, in the PTA utility, run step 16, Installing SSL Client Certificate Issuer Chain (Root, Intermediate(s)). For details, see the step 16 instructions in Install Your Organization's Public Certificate Chains.
  5. On the PTA machine, open the local systemparm.properties configuration file using the LOCALPARM command.
    1. Press i to edit the file.
    2. Value the syslog_inbound parameter as described in systemparm.properties.

Configure PTA trusted connection to SIEM

Secured syslog data requires that a third-party certificate is installed on your PTA Server machine.

  1. Upload each SIEM client certificate to PTA. To do this, in the PTA utility, run step 16, Installing SSL Client Certificate Issuer Chain (Root, Intermediate(s)). For details, see the step 16 instructions in Install Your Organization's Public Certificate Chains.
  2. On the PTA machine, open the local systemparm.properties configuration file using the LOCALPARM command.
    1. Press i to edit the file.
    2. Value the syslog_outbound parameter as described in systemparm.properties using TLS as the protocol. For details, see Send PTA syslog Records to SIEM.