Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new to OSSIM.

My requirement is to detect executable files (.exe) using snort. I have found a snort rule:

 alert tcp any any -> any any (msg: "DLL Windows file download"; flow: established; content:"MZ";isdataat: 76,relative;content:"This program cannot be run in DOS mode."; distance: 0; isdataat: 10,relative; content:"PE"; distance: 0; classtype: misc-activity; sid:5000789;)

I added this in /etc/snort/rules/local.rules and Perl

/usr/share/ossim/scripts/create_sidmap.pl /etc/snort/rules/ 

Then restarte snort:

/etc/init.d/snort restart.

I can see the snort rule detecting the file download when I check the snort binary log in the snort console. BUT I want to see this alert in under Incident-> Alerts section in OSSIM web UI.

What am I missing?

share|improve this question

1 Answer 1

Try using forums.alienvault.com for these kind of questions - they tend to get more answers there.

What you need is a correlation rule. Try out the documentation listed at the forums on how to write one.

share|improve this answer
    
I was unable to find any documents or samples related to this. Can you help me ? –  user851157 Apr 28 '13 at 16:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.