RSA enVision can be configured to pull these logs using the Cisco's SDEE protocol.
You need to allow the enVision server to connect to the IPS through an access-list entry in "service host\network-settings" on the CLI.
From enVision you need to configure the SDEE Collection Service from "Overview\System Configuration\Services\Device Services\Manage SDEE Collection Service". When adding a device just give the IP address of the IPS, a user name for enVision to use to connect, password, and port of 443.
One thing to note, this will give you basic alert information but wont include the TriggerPacket details which are often times helpful in alert investigation. You can check if this is the case by opening the "Cisco Secure Ids.txt" file from the "\nic\csd\config\sdees\templates" directory and see if it contains "cid:triggerPacket". If the file doesn't contain that you can just rename the file to something like "Cisco Secure Ids.old" and then copy the "Cisco Secure Ids.txt" file from
"%_envision%\etc\devices\ciscoidsxml\sdee" to "\nic\csd\config\sdees\templates". Restart the Collector service and you should be good to go.
One final note, the trigger packet data comes over in base64 format so you will need to run that output through a base64 program or script of some sort.
