NAC EVENTS to Thrid Party SIEM

[Jimmy_Payne1]

Does anyone have any hands on experience sending NAC events to a Mcafee SIEM receiver? It appears that everything is set correctly but I am not seeing events in my SIEM. Any help would be greatly appreciated.

[Zdeněk_Pala]

Hi, just another tip/hint. Did you configure SMTP server in Netsight? tools -> options? Zdenek

[Jimmy_Payne1]

Ok. Well I checked the appliance and not the Netsight server.

[Kurt_Semba]

If you configure to forward all NAC end-system events within the Notification Engine in NAC Manager then you should see the events going out of the NetSight (!) appliance, not the NAC appliance. If that still doesn't work, I'd suggest to open a ticket with GTAC so they can gather more data and fix your issue. Thanks Kurt

[Jimmy_Payne1]

Yes I did check that and there seems to be nothing leaving the nac appliance bound for the SIEM. However, I think I have everything selected that needs to be in order for it to send the data. Just very weird.