2

I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?

| improve this question | |
  • Is the main advantage of using the OSSEC agent over rsyslog that it will be encrypted? – user13287 Sep 21 '12 at 18:39
  • 2
    Since product configuration questions generally get knocked off of SSE, we maintain our own support forums over at Alienvault - this is certainly a common topic over there. > forums.alienvault.com – CP Constantine Oct 19 '12 at 8:56
5

For OSSEC you can generate new keys for every agent that will be reporting to the OSSEC server installed in the OSSIM server (check Analysis | Detection | HIDS)

For Snort, the most easy and recommended way is install an OSSIM sensor profile, that comes with the Snort up and provides you the new rules using the command alienvault-update

But if you are not interested in that, because you have a Snort installation working, you can send the unified2 logs to the OSSIM server using rsyslog, and check in the snort.cfg that the directory var is pointing to the correct place.

This issues are explained in the User manual: http://communities.alienvault.com/community/technical-documentation

| improve this answer | |
  • Is it possible for you to explain more about how to send unified2 logs using rsyslog to OSSIM server?! I can't do that in correct way! – Mohsen Gh. May 20 '12 at 14:51
5

I realize that this already has an accepted answer but this is a quick summary of how to set this up.

snort.conf

output alert_syslog: LOG_DAEMON LOG_ALERT

rsyslog.conf

daemon.*  @alienvault-server

ossim_setup.conf

detectors=...,snort_syslog,...

snort_syslog.cfg

location=/var/log/daemon.log
| improve this answer | |
  • You are right!! Your answer is my favorite answer. – Mohsen Gh. May 22 '12 at 7:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.