OSSIM: Difference between revisions
m adjusting infobox to indicate is SIEM software primarily |
Added table of release dates for major version |
||
| Line 17: | Line 17: | ||
The project began in 2003 as a collaboration between Dominique Karg<ref>http://sourceforge.net/users/dkarg</ref> and Julio Casal<ref>http://sourceforge.net/users/jcasal</ref>. In 2008 it becamge the basis for their company AlienVault<ref>http://www.alienvault.com/c-suite-blog/of-dragons-elephants-aliens-a-decade-of-ossim</ref>, which now sells a commercial derivative of OSSIM ('AlienVault Unified Security Management'). |
The project began in 2003 as a collaboration between Dominique Karg<ref>http://sourceforge.net/users/dkarg</ref> and Julio Casal<ref>http://sourceforge.net/users/jcasal</ref>. In 2008 it becamge the basis for their company AlienVault<ref>http://www.alienvault.com/c-suite-blog/of-dragons-elephants-aliens-a-decade-of-ossim</ref>, which now sells a commercial derivative of OSSIM ('AlienVault Unified Security Management'). |
||
OSSIM has had four major-version releases since its creation and is presently on a 4.x.x version numbering<ref>http://forums.alienvault.com/discussion/1340/patch-release-v4-2-3</ref>. An [[Information visualization]] of the contributions to the source code for OSSIM is published at [http://labs.alienvault.com/labs/index.php/2011/8-years-of-ossim/ 8 years of OSSIM] |
OSSIM has had four major-version releases<ref>http://sourceforge.net/projects/os-sim/files/deprecated__check_readme/</ref> since its creation and is presently on a 4.x.x version numbering<ref>http://forums.alienvault.com/discussion/1340/patch-release-v4-2-3</ref>. An [[Information visualization]] of the contributions to the source code for OSSIM is published at [http://labs.alienvault.com/labs/index.php/2011/8-years-of-ossim/ 8 years of OSSIM] |
||
{| style="border="1" |
|||
| ⚫ | As [[SIEM]] system, OSSIM is intended to give security analysts and administrators a view of all the security-related aspects of their system, by combining [[Log_management_and_intelligence|Log Management]] and[[IT_asset_management|Asset Management and Discovery]] with information from dedicated information security controls and detection systems. This information is then correlated together to create contexts to the information not visible from one piece alone. |
||
| Version |
|||
| Release Date |
|||
|- |
|||
| 1.04 |
|||
| 23rd February 2008 |
|||
|- |
|||
| 2.1 |
|||
| 10th July 2009 |
|||
|- |
|||
| 3.0 |
|||
| 16th September 2011 |
|||
|- |
|||
| 4.0 |
|||
| July 17th 2012 |
|||
|} |
|||
| ⚫ | As a [[SIEM]] system, OSSIM is intended to give security analysts and administrators a view of all the security-related aspects of their system, by combining [[Log_management_and_intelligence|Log Management]] and[[IT_asset_management|Asset Management and Discovery]] with information from dedicated information security controls and detection systems. This information is then correlated together to create contexts to the information not visible from one piece alone. |
||
OSSIM performs these functions using other well-known <ref>http://www.sectools.org</ref> [[Open-source software|Open Source Software]] security components, unifying them under a single browser-based user interface. The interface provides graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allows centralized management of configuration options. |
OSSIM performs these functions using other well-known <ref>http://www.sectools.org</ref> [[Open-source software|Open Source Software]] security components, unifying them under a single browser-based user interface. The interface provides graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allows centralized management of configuration options. |
||
Revision as of 21:57, 26 June 2013
 | |
 OSSIM Web Framework | |
| Developer(s) | AlienVault |
|---|---|
| Stable release | 4.2.3
/ June 5, 2013 |
| Operating system | Linux |
| Type | Security / SIEM |
| License | GNU General Public License |
| Website | communities.alienvault.com |
OSSIM (Open Source Security Information Management) by AlienVault is an open source Security Information and Event Management (SIEM), integrating a selection of tools designed to aid network administrators in computer security, intrusion detection and prevention.
The project began in 2003 as a collaboration between Dominique Karg[1] and Julio Casal[2]. In 2008 it becamge the basis for their company AlienVault[3], which now sells a commercial derivative of OSSIM ('AlienVault Unified Security Management').
OSSIM has had four major-version releases[4] since its creation and is presently on a 4.x.x version numbering[5]. An Information visualization of the contributions to the source code for OSSIM is published at 8 years of OSSIM
| Version | Release Date |
| 1.04 | 23rd February 2008 |
| 2.1 | 10th July 2009 |
| 3.0 | 16th September 2011 |
| 4.0 | July 17th 2012 |
As a SIEM system, OSSIM is intended to give security analysts and administrators a view of all the security-related aspects of their system, by combining Log Management andAsset Management and Discovery with information from dedicated information security controls and detection systems. This information is then correlated together to create contexts to the information not visible from one piece alone.
OSSIM performs these functions using other well-known [6] Open Source Software security components, unifying them under a single browser-based user interface. The interface provides graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allows centralized management of configuration options.
The software is distributed freely under the GNU General Public License (a requirement of many of the components being licensed under the same conditions by their authors). Unlike the individual components which may be installed onto an existing system, OSSIM is distributed as an installable ISO image designed to deployed to a physical or virtual host as the core operating system of the host. OSSIM is built using the Debian Linux distribution as its underlying operating system.
Components
Ossim features the following software components:
- Arpwatch, used for MAC address anomaly detection.
- P0f, used for passive OS detection and OS change analysis.
- Pads, used for service anomaly detection.
- Nessus, used for vulnerability assessment and for cross correlation (Intrusion detection system (IDS) vs Vulnerability Scanner).
- Snort, used as an Intrusion detection system (IDS), and also used for cross correlation with Nessus.
- Tcptrack, used for session data information which can grant useful information for attack correlation.
- Ntop, which builds an impressive network information database for aberrant behaviour anomaly detection.
- Nagios, used to monitor host and service availability information based on a host asset database.
- Osiris, a Host-based intrusion detection system (HIDS).
- Snare, a log collector for windows systems.
- OSSEC, a Host-based intrusion detection system (HIDS).
- OSSIM also includes self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins.
See also
External links
- Official OSSIM Project Website
- OSSIM Community Forum
- OSSIM Source Code Repository
- OSSIM Installer Download location
Notes
- ^ http://sourceforge.net/users/dkarg
- ^ http://sourceforge.net/users/jcasal
- ^ http://www.alienvault.com/c-suite-blog/of-dragons-elephants-aliens-a-decade-of-ossim
- ^ http://sourceforge.net/projects/os-sim/files/deprecated__check_readme/
- ^ http://forums.alienvault.com/discussion/1340/patch-release-v4-2-3
- ^ http://www.sectools.org