2

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that these events are noisy and create complacency where I need to see real events. I assume that most people are ignoring these events somehow. I have read online and all I can find is this

How can i prevent alienvault logs from being shown in ossim ?

Judging from the above article , I see that this method is somewhat of a hack.

Here is what I am currently doing . I created two rules for Source of AlienVault and one for the Destination of AlienVault , then set them to No SIEM. Is this a sound practice?

enter image description here

Is it recommended to silence or mute AlienVault alerts?

What is a good or clean way to accomplish this?

1
  • I am having the same problem. I forwarded the question to AlienVault via e-mail.
    – Hacktiker
    Commented Jul 26, 2017 at 7:37

1 Answer 1

0

I reached out to AlienVault via e-mail and they sent me the same workaround you described in your question:

1.- create 2 policies. go to configuration -> threat intelligence -> policies. chose default group.

2.- first policy will have AlienVault Appliance IP as source ip. click new policy. set a name for the policy - like ’from AV' on source ip select alienvault appliance asset from asset tree on destination field select any on siem consequence select no.

3.- Second one, AlienVault Appliance IP as Destination. click new policy. set a name for the policy - like ’to AV' on destination ip select alienvault appliance asset from asset tree on source field select any on siem consequence select no.

4.- Reload Policies You should have a red label/button ‘reload policies’ click it.

This will prevent AlienVault to capture and analyse its own traffic.

1
  • Looks like the same thing that I did.... I'll give the answer as it came from AV themselves..
    – LUser
    Commented Jul 31, 2017 at 10:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .