Jump to content

OSSIM

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Wereote (talk | contribs) at 15:53, 25 October 2016 (→Open Threat Exchange). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

For the GIS project, see Open Source Geospatial Foundation.
OSSIM
Developer(s)AlienVault
Stable release
5.3.0 / August 2, 2016
Operating systemLinux
TypeSecurity / SIEM
LicenseGNU General Public License
Websitealienvault.com

OSSIM (Open Source Security Information Management) is an open source security information and event management system, integrating a selection of tools designed to aid network administrators in computer security, intrusion detection and prevention.

The project began in 2003 as a collaboration between Dominique Karg,[1] Julio Casal [2] and later Alberto Román.[3] In 2008 it became the basis for their company AlienVault.[4] Following the acquisition of the Eureka project label and completion of R&D, AlienVault began selling a commercial derivative of OSSIM ('AlienVault Unified Security Management').

OSSIM has had four major-version releases[5] since its creation and is on a 5.x.x version numbering.[6] An Information visualization of the contributions to the source code for OSSIM is published at 8 years of OSSIM. The project has approximately 7.4 million lines of code.[7]

Version Release date
1.04 23 February 2008
2.1 10 July 2009
3.0 16 September 2011
4.0 17 July 2012
5.0 20 April 2015
5.3 2 August 2016

As a SIEM system, OSSIM is intended to give security analysts and administrators a view of all the security-related aspects of their system, by combining log management and asset management and discovery with information from dedicated information security controls and detection systems. This information is then correlated together to create contexts to the information not visible from one piece alone.

OSSIM performs these functions using other well-known[8] open-source software security components, unifying them under a single browser-based user interface. The interface provides graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allows centralized management of configuration options.

The software is distributed freely under the GNU General Public License. Unlike the individual components which may be installed onto an existing system, OSSIM is distributed as an installable ISO image designed to deployed to a physical or virtual host as the core operating system of the host. OSSIM is built using Debian GNU/Linux distribution as its underlying operating system.

Components

OSSIM features the following software components:

  • PRADS, used to identify hosts and services by passively monitoring network traffic. Added in release v4.0.[9]
  • OpenVAS, used for vulnerability assessment and for cross correlation of (Intrusion detection system (IDS) alerts vs Vulnerability Scanner) information.
  • Snort, used as an Intrusion detection system (IDS), and also used for cross correlation with Nessus.
  • Suricata, used as an Intrusion detection system (IDS), as of version 4.2 this is the IDS used in the default configuration
  • Tcptrack, used for session data information which can grant useful information for attack correlation.
  • Nagios, used to monitor host and service availability information based on a host asset database.
  • OSSEC, a Host-based intrusion detection system (HIDS).
  • Munin, for traffic analysis and service watchdogging.
  • NFSen/NFDump, used to collect and analyze NetFlow information.
  • FProbe, used to generate NetFlow data from captured traffic.
  • OSSIM also includes self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins.

Note: Suricata and Snort cannot be used at the same time. Snort is currently being phased out in favor of Suricata.[10]

Deprecated Components

  • Arpwatch, used for MAC address anomaly detection, replaced by PRADS.
  • P0f, used for passive OS detection and OS change analysis, replaced by PRADS.
  • PADS, used for service anomaly detection, replaced by PRADS.
  • Ntop, for recording traffic patterns between hosts and host groups, and statistics on protocol usage, deprecated.[11]

Open Threat Exchange

AlienVault maintains a crowd-sourced service for IP reputation information, generated by (and available to anyone) with an active OSSIM installation. OTX uses tokenized information from participating OSSIM installations to identify Internet addresses engaged in malicious activities and share that information to those same OSSIM installations. It was launched in 2012[12]

References

  1. ^ http://sourceforge.net/users/dkarg
  2. ^ http://sourceforge.net/users/jcasal
  3. ^ http://sourceforge.net/users/alberto_r
  4. ^ https://www.alienvault.com/blogs/industry-insights/of-dragons-elephants-aliens-a-decade-of-ossim
  5. ^ http://sourceforge.net/projects/os-sim/files/deprecated__check_readme/
  6. ^ http://forums.alienvault.com/discussion/1340/patch-release-v4-2-3
  7. ^ https://www.ohloh.net/p/alienvault-ossim/analyses/latest/languages_summary
  8. ^ http://www.sectools.org
  9. ^ AlienVault, "AlienVault OSSIM v4.0 Enhancement Summary", AlienVault OSSIM v4.0 Enhancement Summary, July 2012
  10. ^ AlienVault, "AlienVault v5.0.3 Patch Release", AlienVault v5.0.3 Patch Release, June 2, 2015
  11. ^ AlienVault, "AlienVault v5.0.3 Patch Release", AlienVault v5.0.3 Patch Release, June 2, 2015
  12. ^ http://www.alienvault.com/alienvault-labs/open-threat-exchange
Retrieved from "https://en.wikipedia.org/w/index.php?title=OSSIM&oldid=746153824"