topic NetApp, event logs and SIEM - ArcSight in Network and Storage Protocols

NetApp, event logs and SIEM - ArcSight

chopisnetapp — Thu, 05 Jun 2025 06:49:04 GMT

I am writing to inquire if anyone has experience with sending audit-file information to a Security Incident and Event Manager (SIEM) like ArcSight.

I am particularly interested in MS file access logs.

NetApp, event logs and SIEM - ArcSight

txskibum2000 — Mon, 01 Aug 2011 20:11:44 GMT

If ArcSight cannot do this natively, then you need Adiscon EventReporter.

NetApp, event logs and SIEM - ArcSight

chopisnetapp — Thu, 06 Oct 2011 18:47:15 GMT

The NetApp administrator and I got this to work - mostly configuration requirements on the NetApp end.

Re: NetApp, event logs and SIEM - ArcSight

NETAPPAIRTRAN — Fri, 27 Jan 2012 01:42:37 GMT

Can you describe what the NetApp admin had to do ?

Re: NetApp, event logs and SIEM - ArcSight

txskibum2000 — Mon, 30 Jan 2012 16:33:49 GMT

We finally went with LogRythm for event log and cifs log reporting. Does this nicely without an agent, etc.

However, nothing I can find can do Real Time File Intergrity Monitoring (FIM) without doing away with NetApp CIFS and migrating the file shares from the NetApp to a Windows front-end Server.

Here is some info on File Integrity Monitoring (FIM):

1. Alerts on any file or folder additions, deletions, modifications, or reads.

2. Can alert on a variety of malicious behaviors, from improper user access of confidential files to botnet related breaches and transmittal of sensitive data.

3. Meets PCI DSS compliance for sections 11.5* and 12.9 – specifically addresses 35 specific mandates of PCI DSS 1.2.

4. Provides a complete set of forensic data for rapidly identifying the root cause of security breaches.

*11.5 mandates that we deploy file integrity monitoring to alert personnel to unauthorized modifications of critical system or content files, and perform file comparisons at least weekly or more frequently.

My two cents.