VMware Collection: Step 1. Configure Event Sources in SA

Configure a VMware Event Source

1. In the Security Analytics menu, select Administration > Services.
2. In the Services grid, select a Log Collector service.
3. Click under Actions and select View > Config.
4. In the Event Sources tab, select VMware/Config from the drop-down menu.
   The Event Categories panel displays the VMware event sources that are configured, if any.
5. In the Event Categories panel toolbar, click .
   
   The newly added event source type is displayed in the Event Categories panel.
6. Select the new type in the Event Categories panel and click in the Sources toolbar.
   The Add Source dialog is displayed.
7. Add a Name, Username and Password, modify any other parameters that require changes, and click OK.

Caution: If you need to enter the domain name as part of the Username, you must use a double-backslash as a separator. For example, if the domain|username is corp\smithj, you must specify corp\\smithj.

The new event source is displayed in the list.

Modify a VMware Event Source

1. In the Security Analytics menu, select Administration > Services.
2. In the Services grid, select a Log Collector service.
3. Click under Actions and select View > Config.
4. Select VMware/Config from the drop-down menu.
5. In the Event Source list, select an event source and click .
   The Edit Source dialog is displayed.
   
   
6. Modify the parameters that require changes and click OK.
   Security Analytics applies the parameter changes to the selected event source.