I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
-
Is the main advantage of using the OSSEC agent over rsyslog that it will be encrypted? – user13287 Sep 21 '12 at 18:39
-
2Since product configuration questions generally get knocked off of SSE, we maintain our own support forums over at Alienvault - this is certainly a common topic over there. > forums.alienvault.com – CP Constantine Oct 19 '12 at 8:56
For OSSEC you can generate new keys for every agent that will be reporting to the OSSEC server installed in the OSSIM server (check Analysis | Detection | HIDS)
For Snort, the most easy and recommended way is install an OSSIM sensor profile, that comes with the Snort up and provides you the new rules using the command alienvault-update
But if you are not interested in that, because you have a Snort installation working, you can send the unified2 logs to the OSSIM server using rsyslog, and check in the snort.cfg that the directory var is pointing to the correct place.
This issues are explained in the User manual: http://communities.alienvault.com/community/technical-documentation
-
Is it possible for you to explain more about how to send unified2 logs using rsyslog to OSSIM server?! I can't do that in correct way! – Mohsen Gh. May 20 '12 at 14:51
I realize that this already has an accepted answer but this is a quick summary of how to set this up.
snort.conf
output alert_syslog: LOG_DAEMON LOG_ALERT
rsyslog.conf
daemon.* @alienvault-server
ossim_setup.conf
detectors=...,snort_syslog,...
snort_syslog.cfg
location=/var/log/daemon.log
answered May 21 '12 at 14:37
