Configuration on

Sending logs to an external security information and event management (SIEM)

Mon, 01 Jan 0001 00:00:00 +0000

This is an optional step.

The following options are available for forwarding logs from the Protector:

The default setup, that is, ESA.
Sending logs to the ESA and a SIEM.

In addition to the ESA or the ESA and a SIEM, logs can be sent to the Amazon CloudWatch. For more information about configuring Amazon CloudWatch, refer to Working with CloudWatch Console.

In the default setup, the logs are sent from the protectors directly to the Audit Store on the ESA using the Log Forwarder on the protector.

Configuring a Trusted Appliance Cluster (TAC) without Consul Integration

Mon, 01 Jan 0001 00:00:00 +0000

For more information about creating a TAC, refer to the section Trusted Appliances Cluster (TAC).

Note: If the node contains scheduled tasks associated with it, then you cannot uninstall the cluster services on it. Ensure that you delete all the scheduled tasks before uninstalling the cluster services.

Note: If you are uninstalling the Consul Integration services, then the Consul related ports and certificates are not required.

To uninstall cluster services, perform the following steps.

Configuring the IP Address for the Docker Interface

Mon, 01 Jan 0001 00:00:00 +0000

From ESA v9.0.0.0, the default IP addresses assigned to the docker interfaces are between 172.17.0.0/16 and 172.18.0.0/16. If your have a VPN or your organization’s network configured with the IP addresses are between 172.17.0.0/16 and 172.18.0.0/16, then this might cause conflict with your organization’s private or internal network resulting in loss of network connectivity.

Note: Ensure that the IP addresses assigned to the docker interface must not conflict with the organization’s private or internal network.

Identifying the protector version

Mon, 01 Jan 0001 00:00:00 +0000

Perform the following steps to identify the PEP server version of the protector:

Log in to the ESA.
Navigate to Policy Management > Nodes.
View the Version field for all the protectors.