Documentation forSecurity Event Manager

Configure SEM connectors for Agent and non-Agent devices

This section describes how to configure SEM connectors.

Add and modify connectors for agent and manager devices

Connectors intercept events sent from a specific product on your network and convert those events into normalized messages that SEM can understand.

  1. In the SEM Events Console, click the Nodes tab.
  2. Under Refine Results, expand the Type group, and then select the Agent check box.
  3. Select an agent, and then click Manage node connectors.


    For Manager connectors, click the Manager Connectors tab to view configured and available connectors.

  4. Find the connector to configure. Type part of the connector name in the search box, or use the filter menus in the Refine Results pane.

  1. Select an available connector, and then click Add Connector.

  2. Complete the connector configuration form. The following fields are common across most connectors:
    • Name: Enter a user-friendly label for your connectors.
    • Log File: Enter the location of the log file that the connector will normalize. This is a location on either the local computer (Agents), or the SEM appliance (non-Agent devices).
    • Output: Normalized, Raw + Normalized, Raw. You only need to configure these values if SEM is configured to save raw (unnormalized) log messages.
  3. Click Add.
  4. To start a connector, select a configured connector, and then click Start.

Configure the sensor and actor connectors for each SEM Agent

Use the connector configuration form to connect the Agent connector to the target product that is either installed on, or remotely logging to the Agent computer. After configuring the Agent connectors, the Manager can monitor and interact with the products and devices on that computer.

Agent connectors run locally to monitor log files, as well as data logged to the Agent computer from remote devices that cannot run an Agent. The active response connectors (actors) allow the Agent to receive instructions from the Manager and perform active responses locally on the Agent computer, such as sending pop-up messages or detaching USB devices.

Use connector profiles to configure multiple Agents

Most Agents in a network include a few different connector configurations. You can streamline your connector configuration process by creating connector profiles. A connector profile groups Agents that share the same connector configuration.

For more information, see Create connector profiles to manage and monitor SEM Agents.