Security Compliance

Difference between a SEM Connector and a SEM Agent

This article provides a high-level explanation of the difference between a SEM Agent and a SEM Connector.

First published date

10/9/2018 2:11 PM

Last published date

5/31/2019 7:20 PM

Overview

This article provides a high-level explanation of the difference between a Security Event Manager (formerly Log & Event Manager) Agent and a SEM Connector.

  • Agent: Client side  - active, encrypted, sending service
  • Connector: SEM server side - passive, receiving translator

Note: Refer to the SEM Admin Guide for more detailed information and requirements.

Product section

Security Event Manager

Resolution

Agent 

  • The SEM Agent collects and normalizes log events, and then sends them to the SEM Manager.
    (Normalized events are translated into human readable format. SEM Manager provides monitoring, correlation, and reporting services, and long-term storage.) 
  • The Agent provides Alert Correlation that allows you to compare log files from a variety of sources to identify patterns that may indicate networking issues, external threats, and insider abuse.
  • The SEM Agent provides additional visibility at the local level for events on workstations and member servers that otherwise might be missed. Software installations and log on failures are just two examples.
  • The Agent runs as a stand-alone service that has its own configuration files, scripts, and so on.
  • In new installations of SEM (version 6.7 and newer), corresponding agent versions communicate by default using a secure certificate, which no longer requires TLS 1.0, 3DES, or anonymous cipher. If you need to connect to earlier agent versions, navigate to the SEM Events Console security tab (Settings > Security), and switch the toggle button to enable lower security settings.
  • The SEM Agent (versions 6.6 and earlier) uses Secure Socket Layer/Transport Layer Security (SSL/TLS).
    (SSL/TLS is a bandwidth-friendly encryption and compression technology that provides a secure communication channel to the SEM Manager. Its impact on the network is very small.)

Connector 

  • The SEM connector collects and normalizes Syslog events. (Normalized events are translated into human readable format.)
  • The host system, OS, or sending device is responsible for sending Syslog event data.
  • If the host device has not been configured to send data using its own Syslog service/daemon, then the SEM connector cannot normalize data.