I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
For OSSEC you can generate new keys for every agent that will be reporting to the OSSEC server installed in the OSSIM server (check Analysis | Detection | HIDS)
For Snort, the most easy and recommended way is install an OSSIM sensor profile, that comes with the Snort up and provides you the new rules using the command alienvault-update
But if you are not interested in that, because you have a Snort installation working, you can send the unified2 logs to the OSSIM server using rsyslog, and check in the snort.cfg that the directory var is pointing to the correct place.
This issues are explained in the User manual: http://communities.alienvault.com/community/technical-documentation
I realize that this already has an accepted answer but this is a quick summary of how to set this up.
protected by Community♦ Apr 19 at 19:21
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?