Enabling Connectivity with Multi-Domain Security Management
Configuring SmartEvent
Page 29
2. In SmartDashboard, create a new host for each computer that contains a component of SmartEvent:
a) Select
Manage > Network Object > New > Check Point > Host
b) In the
General Properties
window, click
Communication
and enter the activation key.
Note
- If the Multi-Domain Server and SmartEvent are installed on different sides of the firewall, add a
rule that allows SIC traffic between them.
c) The version is not entered automatically if the SmartEvent version is newer than the version of the
Multi-Domain Server. If so, select the most recent version available from the
Version
drop-down list.
d) In the
Management Software Blades
list, select the blades that are installed on the new host.
3. Select
Close
and
OK
.
4. From the
File
menu, select
Save
.
5. From the SmartDomain Manager:
a) Do
Install Global Policy
on all CMAs participating with SmartEvent.
b) For each CMA participating with SmartEvent, open its SmartDashboard, select
Policy > Install
Database
, and select only the Log Servers and the CMA from which you want the SmartEvent Intro
or SmartReporter components to read logs.
Enabling Connectivity with Multi-Domain
Security Management
1. Open the SmartEvent Intro client, go to
Policy tab > General Settings > Objects > Customers
, and
add all the CMAs with which you will be working.
2. Objects will be synchronized from the CMAs. The synchronization progress can be monitored from the
status window in the
Overview
pane.
Configuring the SmartEvent Clients
You must perform these configurations to make the components of the SmartEvent functional.
After you have accomplished the tasks for SmartEvent Intro, events will begin to appear in the SmartEvent
Intro client.
After you have accomplished the tasks for SmartReporter, logs will be created and sent to the
SmartReporter database. Reports can then be created.
Defining the Internal Network for SmartEvent
To help SmartEvent Intro determine whether events originated internally or externally, the Internal Network
must be defined. Certain network objects are copied from the management server to the SmartEvent Intro
server during the initial synchronization and updated afterwards periodically. Define the Internal Network
from these objects.
Note
- If running IPS Event Analysis in a Security Management Server environment, the internal network will
be defined automatically from firewall topology information. You can customize the internal network
definition.
In a Multi-Domain Security Management environment, define an internal network for each CMA.
To define the Internal Network:
1. Start the SmartEvent Intro Client.
2. From the
Policy
view, select
General Settings > Initial Settings > Internal Network
.
3. Add objects (hosts, networks, groups, IP ranges) that define your environment's internal network.
