Events are not forwarded to SIEM servers

  • Document ID:7018016
  • Creation Date:02-Sep-2016
  • Modified Date:02-Sep-2016
    • Micro Focus Products:
      Secure Configuration Manager

Environment

NetIQ Secure Configuration Manager 6.0
NetIQ Secure Configuration Manager 6.1

Situation

Events are not forwarded to SIEM servers
When an asset is in compliance with an exception, Secure Configuration Manager does not forward the assessment reports to the Security Information and Event Management (SIEM) solution servers such as NetIQ Sentinel and Splunk.

Resolution

This issue is resolved in SCM 6.1 which can be downloaded from our website:
https://www.netiq.com/Support/vsm/extended/upgrade.asp

Secure Configuration Manager now forwards the assessment reports to the SIEM servers correctly.


Cause

There was an issue with sending events to SIEM when an asset is in compliance with exception. This is a special case where total risk is greater than zero but managed risk is zero.