OSSIM

OSSIM (Open Source Security Information Management) is an open source security information and event management system, integrating a selection of tools designed to aid network administrators in computer security, intrusion detection and prevention.

For the GIS project, see Open Source Geospatial Foundation.
OSSIM
OSSIM Web Framework
Original author(s)Dominique Karg, Julio Casal, Ignacio Cabrera and Alberto Román
Developer(s)AT&T Cybersecurity
Stable release
5.7.5 / September 16, 2019
Operating systemLinux
TypeSecurity / SIEM
LicenseGNU General Public License
Websitealienvault.com

The project began in 2003 as a collaboration between Dominique Karg,[1] Julio Casal [2] and later Alberto Román.[3] In 2008 it became the basis for their company AlienVault.[4] Following the acquisition of the Eureka project label and completion of R&D, AlienVault began selling a commercial derivative of OSSIM ('AlienVault Unified Security Management'). AlienVault was acquired by AT&T Communications and renamed AT&T Cybersecurity in 2019.[5]

OSSIM has had four major-version releases[6] since its creation and is on a 5.x.x version numbering.[7] An Information visualization of the contributions to the source code for OSSIM was published at 8 years of OSSIM. The project has approximately 7.4 million lines of code.[8] The current version of OSSIM is 5.7.5 and was released on September 16, 2019. Information about this release and past versions can be found here

As a SIEM system, OSSIM is intended to give security analysts and administrators a more complete view of all the security-related aspects of their system, by combining log management which can be extended with plugins and asset management and discovery with information from dedicated information security controls and detection systems. This information is then correlated together to create contexts to the information not visible from one piece alone. Alarm and availability views along with reporting capabilities are provided to enhance the capabilities of the tool and its utility to the security and systems engineers.

OSSIM performs these functions using other well-known[9] open-source software security components, unifying them under a single browser-based user interface. The interface provides graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allows centralized management of configuration options.

The software is distributed freely under the GNU General Public License. Unlike the individual components which may be installed onto an existing system, OSSIM is distributed as an installable ISO image designed to be deployed to a physical or virtual host as the core operating system of the host. OSSIM is built using Debian GNU/Linux distribution as its underlying operating system. Due to this core platform being open additional components abilities may be added and extend by the security administrators using standard packages and scripting as needed.

Components

OSSIM features the following software components:

  • PRADS, used to identify hosts and services by passively monitoring network traffic. Added in release v4.0.[10]
  • Snort, used as an Intrusion detection system (IDS), and also used for cross correlation with OpenVAS.
  • Suricata, used as an Intrusion detection system (IDS), as of version 4.2 this is the IDS used in the default configuration
  • Tcptrack, used for session data information which can grant useful information for attack correlation.
  • Munin, for traffic analysis and service watchdogging.
  • NFSen/NFDump, used to collect and analyze NetFlow information.
  • FProbe, used to generate NetFlow data from captured traffic.
  • Nagios, used to monitor hosts and specified ports for asset availability a well as full local system Monitoring. [11]
  • OpenVas, is used for vulnerability assessment and associated to assets.
  • OSSIM also includes self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins.

Note: Suricata and Snort cannot be used at the same time. Snort is currently being phased out in favor of Suricata.[12]

Deprecated Components
  • Arpwatch, used for MAC address anomaly detection, replaced by PRADS.
  • P0f, used for passive OS detection and OS change analysis, replaced by PRADS.
  • PADS, used for service anomaly detection, replaced by PRADS.
  • Ntop, for recording traffic patterns between hosts and host groups, and statistics on protocol usage, deprecated.[13]

Open Threat Exchange

AlienVault maintains a crowd-sourced service for IP reputation information, generated by (and available to anyone) with an active OSSIM installation. OTX uses tokenized information from participating OSSIM installations to identify Internet addresses engaged in malicious activities and share that information to those same OSSIM installations. It was launched in 2012[14]

gollark: As ever, I continue being right.
gollark: As always.
gollark: Wow, my ban was retroactively justified perfectly.
gollark: Tux1 is a member of the set ∀N∈ℝ TuxN.
gollark: Well, I guess you have 11 days and 13 hours on the server.

References
  1. http://sourceforge.net/users/dkarg
  2. http://sourceforge.net/users/jcasal
  3. http://sourceforge.net/users/alberto_r
  4. https://www.alienvault.com/blogs/industry-insights/of-dragons-elephants-aliens-a-decade-of-ossim
  5. https://www.alienvault.com/blogs/security-essentials/att-cybersecurity-is-born
  6. http://sourceforge.net/projects/os-sim/files/deprecated__check_readme/
  7. http://forums.alienvault.com/discussion/1340/patch-release-v4-2-3
  8. https://www.ohloh.net/p/alienvault-ossim/analyses/latest/languages_summary
  9. http://www.sectools.org
  10. AlienVault, "AlienVault OSSIM v4.0 Enhancement Summary", AlienVault OSSIM v4.0 Enhancement Summary, July 2012
  11. David Josephsen (27 March 2013). Nagios: Building Enterprise-Grade Monitoring Infrastructures for Systems and Networks. Prentice Hall. ISBN 978-0-13-313568-8.
  12. AlienVault, "AlienVault v5.0.3 Patch Release", AlienVault v5.0.3 Patch Release, June 2, 2015
  13. AlienVault, "AlienVault v5.0.3 Patch Release", AlienVault v5.0.3 Patch Release, June 2, 2015
  14. http://www.alienvault.com/alienvault-labs/open-threat-exchange
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.