2

I have installed Alien Vault into my environment and I am seeing a ton of logs going into the SIEM. Upon further investigation, I see that these are being generated by AlienVault itself. I think that these events are noisy and create complacency where I need to see real events. I assume that most people are ignoring these events somehow. I have read online and all I can find is this

How can i prevent alienvault logs from being shown in ossim ?

Judging from the above article , I see that this method is somewhat of a hack.

Here is what I am currently doing . I created two rules for Source of AlienVault and one for the Destination of AlienVault , then set them to No SIEM. Is this a sound practice?

enter image description here

Is it recommended to silence or mute AlienVault alerts?

What is a good or clean way to accomplish this?

  • I am having the same problem. I forwarded the question to AlienVault via e-mail. – Hacktiker Jul 26 '17 at 7:37
0

I reached out to AlienVault via e-mail and they sent me the same workaround you described in your question:

1.- create 2 policies. go to configuration -> threat intelligence -> policies. chose default group.

2.- first policy will have AlienVault Appliance IP as source ip. click new policy. set a name for the policy - like ’from AV' on source ip select alienvault appliance asset from asset tree on destination field select any on siem consequence select no.

3.- Second one, AlienVault Appliance IP as Destination. click new policy. set a name for the policy - like ’to AV' on destination ip select alienvault appliance asset from asset tree on source field select any on siem consequence select no.

4.- Reload Policies You should have a red label/button ‘reload policies’ click it.

This will prevent AlienVault to capture and analyse its own traffic.

  • Looks like the same thing that I did.... I'll give the answer as it came from AV themselves.. – Qndel Jul 31 '17 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.