we've recently moved our NIDS installation from StrataGuard to the new OSSIM 2.1 release to take advantage of the additional features (Nagios, ntop, Nessus/OpenVas, etc.) it provides in addition to just Snort. So far, I'm very impressed with OSSIM but also slightly overwhelmed with the complexity and sheer amount of information provided.
Where StrataGuard made it very easy to tune and configure rules, e.g. to exclude or specify combinations of source/destination addresses and ports for a given rule, I'm having a very difficult time figuring out how to tune rules in OSSIM from the different event sources (Snort, rrd, arpwatch, directive_alert, etc.). The documentation is pretty sparse at present and doesn't appear to say much about this.
My question is, am I missing something, i.e. should I be approaching at a different level? Should I be configuring the Policy and Correlation elements only, and let the events pour in, even if I know they're false positives? Or is there a straightforward way to tune rules for each sensor?
Thanks for your help.
Update: A nice review article from Linux Journal has been made available through the AlienVault web site that explains the correlation process in more depth than I've seen, and provides a nice overall review of the OSSIM system.
