Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?

share|improve this question
Is the main advantage of using the OSSEC agent over rsyslog that it will be encrypted? – user13287 Sep 21 '12 at 18:39
1  
Since product configuration questions generally get knocked off of SSE, we maintain our own support forums over at Alienvault - this is certainly a common topic over there. > forums.alienvault.com – CP Constantine Oct 19 '12 at 8:56

2 Answers

up vote 3 down vote accepted

For OSSEC you can generate new keys for every agent that will be reporting to the OSSEC server installed in the OSSIM server (check Analysis | Detection | HIDS)

For Snort, the most easy and recommended way is install an OSSIM sensor profile, that comes with the Snort up and provides you the new rules using the command alienvault-update

But if you are not interested in that, because you have a Snort installation working, you can send the unified2 logs to the OSSIM server using rsyslog, and check in the snort.cfg that the directory var is pointing to the correct place.

This issues are explained in the User manual: http://communities.alienvault.com/community/technical-documentation

share|improve this answer
Is it possible for you to explain more about how to send unified2 logs using rsyslog to OSSIM server?! I can't do that in correct way! – Mohsen May 20 '12 at 14:51
up vote 2 down vote

I realize that this already has an accepted answer but this is a quick summary of how to set this up.

snort.conf

output alert_syslog: LOG_DAEMON LOG_ALERT

rsyslog.conf

daemon.*  @alienvault-server

ossim_setup.conf

detectors=...,snort_syslog,...

snort_syslog.cfg

location=/var/log/daemon.log
share|improve this answer
You are right!! Your answer is my favorite answer. – Mohsen May 22 '12 at 7:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.