Exporting alerts from Endpoint Security Server

You can set up the NDR to receive alerts from other appliances by setting up the HTTP Listener. You must configure the NDR and then the other appliance(s).

The NDR HTTP listener is configured using the CLI.

Configure the NDR appliance

To configure NDR appliance for the HTTP Listener:

Log in to the NDR as npadmin using the NDR IP address or FQDN. For example:
$ ssh npadmin@10.1.0.1
or
$ ssh npadmin@exampleFQDN
Enter privileged mode:
npadmin@ia> enable
Enter the npadmin password. The password can be 5 to 24 characters long.
[sudo] password for npadmin: <password>
Enter configuration mode:
npadmin@ia# configure system
Enter the alert aggregation menu:
alertaggregator
At the alert menu, type A and then press Enter to add a new endpoint.
1. Type the api type HX as H.
2. Provide the api address.
3. Press Enter in the Port Number field to retain default value.
4. Provide the username as admin.
5. Type the endpoint security server password and then press Enter.
From the alert aggregator menu, select endpoint security server by its index.
On the Edit / Delete Endpoint menu, type T to toggle alert polling for the device and turn it ON.
Type X and press Enter to save the configuration.
Type X and press Enter to save and exit the endpoint configuration menu.