Blue Coat Systems Content Analysis configuration

This section describes how to send logs from Blue Coat Systems Content Analysis to the Trellix Comm Broker using syslog.

Prerequisites

CA Version 2.1

To send logs from Blue Coat Systems Content Analysis:

Configure the syslog server (the Trellix Comm Broker) using parameters shown in the following table.

Parameter	Description
`PREDICTIVE_ANALYSIS_BLOCK`	File was blocked using predictive analysis.
`REBOOT`	The appliance was restarted.
`SANDBOXING_BLOCK`	File was blocked using sandboxing results.
`SANDBOX_RESULT`	Sandboxing result alert (asynchronous).
`VIRUS`	Virus was found.

Example

(config) # alerts destinations syslog [ SANDBOXING_BLOCK SANDBOX_RESULT ]

Use the alerts syslog-alerts command with parameters shown in the table below to configure syslog settings so Content Analysis can send alerts using syslog messages.

Parameter	Description
`facility`	The level of detail and format, as required by the Trellix Comm Broker Sender. See the Comm Broker documentation for more information.
`port <number>`	The port used by the Comm Broker Sender to listen for incoming data. The default port number is 514.
`protocol udp \| tcp \| tls`	The transport protocol used by the Comm Broker Sender. The default protocol is UDP.
`server <hostname or IP address>`	The IP address or hostname of the Comm Broker Sender.

Example

(config) # alerts syslog-alerts server 192.168.24.30