Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to OSSIM.

My requirement is to detect executable files (.exe) using snort. I have found a snort rule:

 alert tcp any any -> any any (msg: "DLL Windows file download"; flow: established; content:"MZ";isdataat: 76,relative;content:"This program cannot be run in DOS mode."; distance: 0; isdataat: 10,relative; content:"PE"; distance: 0; classtype: misc-activity; sid:5000789;)

I added this in /etc/snort/rules/local.rules and Perl

/usr/share/ossim/scripts/ /etc/snort/rules/ 

Then restarte snort:

/etc/init.d/snort restart.

I can see the snort rule detecting the file download when I check the snort binary log in the snort console. BUT I want to see this alert in under Incident-> Alerts section in OSSIM web UI.

What am I missing?

share|improve this question

Try using for these kind of questions - they tend to get more answers there.

What you need is a correlation rule. Try out the documentation listed at the forums on how to write one.

share|improve this answer
I was unable to find any documents or samples related to this. Can you help me ? – user851157 Apr 28 '13 at 16:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.