Alienvault's community edition SIEM

learn more… | top users | synonyms

0
votes
1answer
25 views

How to filter errors 404 to show only those which are related to php files?

One of my web servers is getting flooded with requests to resources that do not exist anymore, generating the corresponding 404 error. As I'm using OSSEC and OSSIM, then these errors are sent to the ...
0
votes
0answers
30 views

snort is not alerting to a web console

I am configuring snort in OSSIM, modified the snort.debian.conf and when I check the status it gives OK. But it is not logging as I have checked the file. How can I get the alerts logged and on the ...
0
votes
0answers
102 views

Snort configuration in OSSIM

I am working on snort, the one built-in with OSSIM. I am trying to configure it to get the alerts on ossim web-interface but I am unable to even start it properly. I am using 1 NIC although have ...
2
votes
1answer
589 views

How to send NAGIOS alerts to OSSIM server

I've installed an OSSIM server and I wanto to retrieve the alerts generated by a remote Nagios server in order to analyze them and perform correlation of security events. Before putting hands on it, ...
0
votes
1answer
244 views

OSSIM Alarms for Snort rules

I'm new to OSSIM. My requirement is to detect executable files (.exe) using snort. I have found a snort rule: alert tcp any any -> any any (msg: "DLL Windows file download"; flow: established; ...
1
vote
0answers
1k views

Network Monitoring on KVM guest - configuring network interfaces for OSSIM/snort/etc

I've configured a KVM host on a new Ubuntu 9.10 x64 server installation, and am having trouble getting an OSSIM (snort+nagios+openvas on debian Lenny) installation going as a guest. I've configured ...
1
vote
3answers
6k views

How to configure sensor rules in OSSIM

we've recently moved our NIDS installation from StrataGuard to the new OSSIM 2.1 release to take advantage of the additional features (Nagios, ntop, Nessus/OpenVas, etc.) it provides in addition to ...
3
votes
2answers
2k views

OSSIM - Snort/OSSEC/Nagios Logging Config Question

Quick n00b OSSIM question. I've looked around but haven't found exactly what I'm looking for. I currently have a Nagios, OSSEC, Nessus, and Snort server and I want to keep those servers active but ...
3
votes
1answer
571 views

OSSIM In Production Environment

I am trying to get some real-world feedback on OSSIM. Are you using OSSIM in production? If so, what has your overall experiance been? How many nodes are in your enviroment? Finally, what kind ...