Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Been trying for a week now to get AlienVault (referred to as AV hereon) running with little success.

I've gone through 2 installs so far.

First time messing with SIEM, though have very limited experience with log collection (splunk, kiwi).

Very small network. <10 workstations (win7); 1 Windows server (2008);AD; 2 Linux servers; 1 firewall with IDS, GatewayAV & syslog pointing to AV. No DMZ, no local mail, no VPN or other external access.

On the first install, I did a manual config and selected plugins/detectors all willy-nilly. I did an asset discovery scan which seemed to work. Though, over the course of a couple of days, my service level dropped to 0. I think this was due to the fact that the thresholds were set too low for the amount of surfing our users do. The risk metrics page drilled down through the machines showing traffic etc for each. I also installed SNARE on the Win server box and we met with message too large errors which I was able to correct with a syslog local rules entry:

<rule id="1003" level="0" maxsize="1025" overwrite="yes">
    <description>Non standard syslog message (size too large).</description>

and I pointed the plugin cfg locations to syslog for both snare and firewall since I couldn't get rsyslog to pull out their respective entries. It seemed to be working with the firewall plugin, but didn't notice anything from snare.

Eventually, I ran ossim-update which borked the machine (plugins stopped working; mysql connection issues; ossim-agent connection issues).

Second install I went the same route, though with an automated install. However, I installed ossec agent on windows server (with IP and auth token), but haven't seen any events from it. But, this did initiate a snare entry for a new process.

The assets seems to be different, though. On the risk metrics, it does not have the drill-down as it did on the first install. Also, I raised global threshold and though my service level isn't dropping, the attack or compromise metrics don't seem to be increasing at all. It's as if the LAN machines aren't triggering the same stuff it was before for some reason. Firewall events are aplenty. I tried running a vuln scan which creates tickets, but never finishes (it just sits in running scans even though scanner status is idle, thus I can't run through the HTML report and mark false +'s).

So, questions:

  • What plugins should I be utilizing considering the network layout?

  • What is the best way to get the assets in there? Should I skip the asset discover alltogether and install agents?

  • How exactly do the policies work? i.e. are there any examples of default policies out there? are the necessary at this level? (I could not find any; AV forum had talk of some being included back in '09, but hasn't happened)

  • Are there alternative (open source!) solutions that may work better for our situation? (NB: have explored snorby, cyberoam; I may have become biased because I've already invested so much time in AV)

Much thanks.

share|improve this question

closed as too localized by Rory Alsop Jun 13 '12 at 18:05

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Have you tried reading the friendly manual? – Chris S Jun 13 '12 at 18:03
This seems like something you want to either read the manual on, as Chris pointed out, or discuss with your vendors. I know an org who use similar products and they just get the vendor to help out with anything non standard. – Rory Alsop Jun 13 '12 at 18:06
@ChrisS Can you point me to it? I have read every one I can get my hands on and they are littered with incomplete details e.g. (Image removed, broken link, I’m very sorry. DK.) As linked to from – bubbl35 Jun 13 '12 at 18:17
Please read the FAQ - this is not a security question. It is a product config question - doesn't matter that it is a security product. Also, think about how you come across when entering a new site for the first time. – Rory Alsop Jun 13 '12 at 18:39
@bubbl35 I don't have any myself, it just wasn't evident from your Question that you had in fact read any. My apologies for asking the obvious. This is a security site regardless, and application configuration questions are off-topic here. Our sister sites Server Fault handles network administration and Super User for application configuration may be of interest; but you'll definitely want to contact the vendor first as (forgive the simplification) "where do I start" questions are generally going to be off-topic on all our sites. – Chris S Jun 13 '12 at 19:14