Search Results for "correlation"

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

TL;DR Version: I wrote a tool called GIPC (short for Geographical IP Correlation and pronounced Gypsy) which takes a list of IP address and returns the Geographical information you select based on the MaxMind.com GeoCity Database. The exe requires 2 inputs: The IP file (one IP per line) MaxMind GeoCity database – This can be downloaded HERE:http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz Please read more on my blog: http://jcsocal.blogspot.com/2013/03/geographical-ip-correlation-tool.html

Vigilo is a complete monitoring system designed for large environments thanks to a fully scalable and modular architecture. Built around Nagios, Vigilo integrates metrology graphs, map views, events correlation and reporting.

PortscanGeoinfo is a plugin for the powerful Prelude correlation engine. This plugin correlates alerts from Snort NIDS and OSSEC HIDS sensors regarding portscans. Geographical information (GeoIP) is included in the correlated alert.

Canopsis is the first Open Source Hypervisor. It's built on top of existing monitoring solutions (Shinken, Nagios, Syslog)… Its goals is to correlate events from those solutions and fills the gap between technical monitoring and business monitoring.