iLo Active Directory Authentication and event logs

[Al W.]

I was wondering if anyone can confirm my observations or can report actual success in what I am trying to accomplish.

I am using a Security Incident and Event Monitor application an am trying to capture the events of either succesfully or unsucessfully logging into iLo. My goal would be to detect an attack, perhaps even detect an an authorized account login at an inappropriate time, or have the event for forensics later on.

It is my first round conclusion that Active Directory is not recording the source of the authentication, ie, it can't tell one iLo from another iLo.

Using the Dell equivalent, DRAC, has been easy, since it can output events in syslog. I don't have any iLo, but my understanding is that it has SNMP, which I dread trying to configure on my SIEM side.

[Ali]

Hi There,

I guess, You are looking for directory-enabled remote management. You can use HP schema directory integration with ILO to achieve this.

please refer ILO 2 userguide
http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00553302/c00553302.pdf

thanks,
Aftab