OSSIM, The Open Source SIEM

Hi,

any step by step guide to confgure snort in ossim ?

Thanks and Regards,

Kaushal

you can configure snort by running
# dpkg-reconfigure snort

then specify all the interfaces you wish to listen to its traffic. At least
that is what i did for version 1.x last year ;)
there are more info at the forum

https://www.alienvault.com/forum/index.php?t=thread&frm_id=44&S=ef36d934597aec19c780ea0a56c68ab1

2010/3/11 Kaushal Shriyan <kaushalshriyan@...>

> Hi,
>
> any step by step guide to confgure snort in ossim ?
>
> Thanks and Regards,
>
> Kaushal
>
>
> ------------------------------------------------------------------------------
> Download Intel&#174; Parallel Studio Eval
> Try the new software tools for yourself. Speed compiling, find bugs
> proactively, and fine-tune applications for parallel performance.
> See why Intel Parallel Studio got high marks during beta.
> http://p.sf.net/sfu/intel-sw-dev
> _______________________________________________
> Os-sim-support mailing list
> Os-sim-support@...
> https://lists.sourceforge.net/lists/listinfo/os-sim-support
>



-- 
Regards,

Umarzuki Mochlis
http://debmal.my

On Thu, Mar 11, 2010 at 8:20 PM, Umarzuki Mochlis <umarzuki@...> wrote:
> you can configure snort by running
> # dpkg-reconfigure snort
> then specify all the interfaces you wish to listen to its traffic. At least
> that is what i did for version 1.x last year ;)
> there are more info at the forum
> https://www.alienvault.com/forum/index.php?t=thread&frm_id=44&S=ef36d934597aec19c780ea0a56c68ab1
>
> 2010/3/11 Kaushal Shriyan <kaushalshriyan@...>
>>
>> Hi,
>>
>> any step by step guide to confgure snort in ossim ?
>>
>> Thanks and Regards,
>>
>> Kaushal
>>
>>
>> ------------------------------------------------------------------------------
>> Download Intel&#174; Parallel Studio Eval
>> Try the new software tools for yourself. Speed compiling, find bugs
>> proactively, and fine-tune applications for parallel performance.
>> See why Intel Parallel Studio got high marks during beta.
>> http://p.sf.net/sfu/intel-sw-dev
>> _______________________________________________
>> Os-sim-support mailing list
>> Os-sim-support@...
>> https://lists.sourceforge.net/lists/listinfo/os-sim-support
>
>
>
> --
> Regards,
>
> Umarzuki Mochlis
> http://debmal.my
>

Hi Umarzuki,

I am newbie to snort. On what parameters or basis do i need to
configure ruleset in snort. I am using snort under OSSIM Application.

Please suggest/guide.

Thanks and Regards,

Kaushal

>
> I am newbie to snort. On what parameters or basis do i need to
> configure ruleset in snort. I am using snort under OSSIM Application.
>
> Please suggest/guide.
>
> Thanks and Regards,
>
> Kaushal
>

you can try reading the article from
http://packetstormsecurity.nl/papers/IDS/snort_rules.htm as i'm new to snort
as well


-- 
Regards,

Umarzuki Mochlis
http://debmal.my

On Wed, Mar 17, 2010 at 10:29 AM, Umarzuki Mochlis <umarzuki@...> wrote:
>> I am newbie to snort. On what parameters or basis do i need to
>> configure ruleset in snort. I am using snort under OSSIM Application.
>>
>> Please suggest/guide.
>>
>> Thanks and Regards,
>>
>> Kaushal
>
> you can try reading the article
> from http://packetstormsecurity.nl/papers/IDS/snort_rules.htm as i'm new to
> snort as well
>
>
> --
> Regards,
>
> Umarzuki Mochlis
> http://debmal.my
>

Hi,

I have installed OSSIM 2.2 on my server. basically i have configured
snort at the backend using
http://sites.google.com/site/ossimnewbie/Home/Configure-snort
I am using oinkmaster to update snort rules.

Basically is there a way to look at the web interface to view or
configure or view snort alerts or logs which has been configured in
the backend.

Thanks and Regards,

Kaushal

Hi,

snort on ossim.

1)I did port mirrroring
2)run ossim-setup and in sensor configuration select those interfaces
in listening mode (With port mirroring configured)
3) After running ossim-setup, it ran ossim-reconfig and restarted all
the services.
I have configured the email address also.

just wanted to understand about "where do i look for any intrusion
which occurs and captured by snort/ossim" ?

Please suggest/guide.

Thanks and Regards,

Kaushal