I'm new to OSSIM.
My requirement is to detect executable files (.exe) using snort. I have found a snort rule:
alert tcp any any -> any any (msg: "DLL Windows file download"; flow: established; content:"MZ";isdataat: 76,relative;content:"This program cannot be run in DOS mode."; distance: 0; isdataat: 10,relative; content:"PE"; distance: 0; classtype: misc-activity; sid:5000789;)
I added this in
/etc/snort/rules/local.rules and Perl
Then restarte snort:
I can see the snort rule detecting the file download when I check the snort binary log in the snort console. BUT I want to see this alert in under Incident-> Alerts section in OSSIM web UI.
What am I missing?