Menu
▾
▴
os-sim-support — Support requests
You can subscribe to this list here.
| 2003 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
(1) |
Sep
(1) |
Oct
|
Nov
|
Dec
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2004 |
Jan
|
Feb
(2) |
Mar
(9) |
Apr
(54) |
May
(9) |
Jun
(17) |
Jul
(21) |
Aug
(12) |
Sep
(14) |
Oct
(11) |
Nov
(25) |
Dec
(2) |
| 2005 |
Jan
(1) |
Feb
(4) |
Mar
(1) |
Apr
(27) |
May
(15) |
Jun
(14) |
Jul
(5) |
Aug
(6) |
Sep
(8) |
Oct
(14) |
Nov
(11) |
Dec
(48) |
| 2006 |
Jan
(43) |
Feb
(5) |
Mar
(23) |
Apr
(6) |
May
(5) |
Jun
(39) |
Jul
(9) |
Aug
(5) |
Sep
(4) |
Oct
(4) |
Nov
(8) |
Dec
|
| 2007 |
Jan
(2) |
Feb
(34) |
Mar
(30) |
Apr
(8) |
May
(20) |
Jun
(63) |
Jul
(14) |
Aug
(69) |
Sep
(27) |
Oct
(33) |
Nov
(19) |
Dec
(16) |
| 2008 |
Jan
(45) |
Feb
(16) |
Mar
(26) |
Apr
(15) |
May
(23) |
Jun
(7) |
Jul
(3) |
Aug
(1) |
Sep
|
Oct
|
Nov
(3) |
Dec
|
| 2009 |
Jan
(9) |
Feb
|
Mar
(1) |
Apr
|
May
(3) |
Jun
(1) |
Jul
(2) |
Aug
(5) |
Sep
(29) |
Oct
(11) |
Nov
(4) |
Dec
|
| 2010 |
Jan
|
Feb
(1) |
Mar
(8) |
Apr
(14) |
May
|
Jun
(4) |
Jul
(4) |
Aug
(7) |
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2011 |
Jan
(1) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2012 |
Jan
(1) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2014 |
Jan
|
Feb
(1) |
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2017 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(1) |
Oct
|
Nov
|
Dec
|
| 2018 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(5) |
Dec
|
| 2021 |
Jan
|
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Abdul Q. H. A. K. <abd...@gm...> - 2021-03-17 06:03:06
|
I'm experiencing issues with updating from 5.7.6 to 5.8.0. I ran /usr/bin/alienvault-update -c -v -d and nothing happened after it finished its update. Manually rebooting the application doesn't seem like it updated the version either (even though according to the logs, it has updated the packages). Can anyone help? Logs can be found here: https://del.dog/alienvault-didnt-update-reboot.log -- <https://about.me/qoyyuum?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=gmail_api&utm_content=thumb> Abdul Qoyyuum Haji Abdul Kadir about.me/qoyyuum <https://about.me/qoyyuum?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=gmail_api&utm_content=thumb> |
|
From: Сеньков Н. В. <n.s...@ze...> - 2018-11-20 09:50:11
|
On basic, It was been used the doc on site https://ossec-docs.readthedocs.io/en/latest/manual/agent/agent-dhcp-nat.html Problem in next: After change dhcp ip on 0.0.0.0 the status ossec agents is changed on "is not active" #/var/ossec/bin/list_agents -n |grep senkov-pc senkov-pc-172.20.75.104 is not active. Another command is display #/var/ossec/bin/agent_control -l |grep 0.0 | grep "Never connected"|grep senkov-pc ID: 051, Name: senkov-pc, IP: 0.0.0.0/0, Never connected In WebUI I see the status HIDS agents - Disconnected, however the agent is starting and in log on workstation 2018/11/20 12:19:07 INFO: Connected to 172.20.75.90 at address 172.20.75.90:1514, port 1514 2018/11/20 12:19:28 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '172.20.75.90'. Here, 172.20.75.90 is ip ossec server The ossec agents on the workstations I installed throoth auto_sec script, whitch I downloaded from the site: github.com/BinaryDefense/auto-ossec After agent installation I made follow: 1. On ossec server 1.1. In WebUI I wrote 0.0.0.0 for the asset that match my workstation (senkov-pc) 1.2. In the file /var/ossec/etc/client.keys I changed dinamic IP address on 0.0.0.0/24 051 senkov-pc 0.0.0.0/0 xxxxxxxxx 2. On workstation 2.1. I changed dynamic address on 0.0.0.0 in file C:\Program Files (x86)\ossec-agent\client.keys 051 senkov-pc 0.0.0.0 xxxxxxxxxxx On ossec server: #/var/ossec/bin/agent_control -la |grep senkov-pc ID: 051, Name: senkov-pc, IP: 0.0.0.0/0, Never connected 3. rids folder I removed all the files in file /var/ossec/queue/rids on ossec server and in C:\Program Files (x86)\ossec-agent\rids on the workstation 4. Start ossec 4.1./etc/init.d/ossec restart 4.2.started the agent on the workstation I don't see my agent in the list installed agents however the agent is installed on workstation and started /var/ossec/bin/list_agents-c |grep senkov-pc Agent log: 2018/11/13 11:48:59 ossec-agentd: INFO: Trying to connect to server 172.20.75.90, port 1514. 2018/11/13 11:48:59 INFO: Connected to 172.20.75.90 at address 172.20.75.90:1514, port 1514 2018/11/13 11:49:20 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '172.20.75.90'. 5. testing tcpdump # tcpdump -i eth0 host 172.20.75.104 and port 1514 -vvv tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 11:55:01.327672 IP (tos 0x0, ttl 128, id 20966, offset 0, flags [none], proto UDP (17), length101) senkov-pc.is01.dom.ru.56159 > is01sr048.alienvault.1514: [udp sum ok] UDP, length 73 Regard, Nikolay |
|
From: Сеньков Н. В. <n.s...@ze...> - 2018-11-19 10:33:25
|
Good day, All. On basic, It was been used the doc on site https://ossec-docs.readthedocs.io/en/latest/manual/agent/agent-dhcp-nat.html Problem in next: After change dhcp ip on 0.0.0.0 the status ossec agents is changed on "is not active" # /var/ossec/bin/list_agents -n |grep senkov-pc senkov-pc-172.20.75.104 is not active. Another command is display # /var/ossec/bin/agent_control -l |grep 0.0 | grep "Never connected" |grep senkov-pc ID: 051, Name: senkov-pc, IP: 0.0.0.0/0, Never connected The ossec agents on the workstations I installed throoth auto_sec script, whitch I downloaded from the site: github.com/BinaryDefense/auto-ossec After agent installation I made follow: 1. On ossec server 1.1. In WebUI I wrote 0.0.0.0 for the asset that match my workstation (senkov-pc) 1.2. In the file /var/ossec/etc/client.keys I changed dinamic IP address on 0.0.0.0/24 051 senkov-pc 0.0.0.0/0 xxxxxxxxx 2. On workstation 2.1. I changed dynamic address on 0.0.0.0 in file C:\Program Files (x86)\ossec-agent\client.keys 051 senkov-pc 0.0.0.0 xxxxxxxxxxx On ossec server: # /var/ossec/bin/agent_control -la |grep senkov-pc ID: 051, Name: senkov-pc, IP: 0.0.0.0/0, Never connected 3. rids folder I removed all the files in file /var/ossec/queue/rids on ossec server and in C:\Program Files (x86)\ossec-agent\rids on the workstation 4. Start ossec 4.1. /etc/init.d/ossec restart 4.2. started the agent on the workstation I don't see my agent in the list installed agents however the agent is installed on workstation and started /var/ossec/bin/list_agents -c |grep senkov-pc Agent log: 2018/11/13 11:48:59 ossec-agentd: INFO: Trying to connect to server 172.20.75.90, port 1514. 2018/11/13 11:48:59 INFO: Connected to 172.20.75.90 at address 172.20.75.90:1514, port 1514 2018/11/13 11:49:20 ossec-agentd(4101): WARN: Waiting for server reply (not started). Tried: '172.20.75.90'. 5. testing tcpdump # tcpdump -i eth0 host 172.20.75.104 and port 1514 -vvv tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 11:55:01.327672 IP (tos 0x0, ttl 128, id 20966, offset 0, flags [none], proto UDP (17), length 101) senkov-pc.is01.zenit.ru.56159 > is01sr048.alienvault.1514: [udp sum ok] UDP, length 73 Nikolay |
|
From: Сеньков Н. В. <n.s...@ze...> - 2018-11-16 07:54:20
|
Hello, In ossec agent log for same host (PDS2) alert for different event is not resolved srcip in ip or asset name AV - Alert - "1542351904" --> RID: "5715"; RL: "3"; RG: "syslog,sshd,authentication_success,"; RC: "SSHD authentication success."; USER: "oracle"; SRCIP:"172.20.191.17"; HOSTNAME: "pds2"; LOCATION: "/var/log/auth.log"; EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: Accepted publickey for oracle from 172.20.191.17 port 61956 ssh2[END]"; AV - Alert - "1542351904" --> RID: "5501"; RL: "3"; RG: "pam,syslog,authentication_success,"; RC: "Login session opened."; USER: "None"; SRCIP: "None"; HOSTNAME: "pds2"; LOCATION: "/var/log/auth.log"; EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: pam_unix(sshd:session): session opened for user oracle by (uid=0)[END]"; 2018-11-16 00:05:02,134 Detector [WARNING]: ssh[4003] Event's field dst_ip pds2 is not a valid IP.v4/IP.v6 address, falling back to default: 0.0.0.0 2018-11-16 00:05:02,135 Detector [WARNING]: ssh[4003] Event's device field pds2 is not a valid IP.v4/IP.v6 address, falling back to default local. Regard, Nikolay |
|
From: Сеньков Н. В. <n.s...@ze...> - 2018-11-16 07:26:51
|
Hello, In ossec agent log for same host (PDS2) alert for different event is not resolved srcip in ip or asset name AV - Alert - "1542351904" --> RID: "5715"; RL: "3"; RG: "syslog,sshd,authentication_success,"; RC: "SSHD authentication success."; USER: "oracle"; SRCIP:"172.20.191.17"; HOSTNAME: "pds2"; LOCATION: "/var/log/auth.log"; EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: Accepted publickey for oracle from 172.20.191.17 port 61956 ssh2[END]"; AV - Alert - "1542351904" --> RID: "5501"; RL: "3"; RG: "pam,syslog,authentication_success,"; RC: "Login session opened."; USER: "None"; SRCIP: "None"; HOSTNAME: "pds2"; LOCATION: "/var/log/auth.log"; EVENT: "[INIT]Nov 16 10:05:02 pds2 sshd[100563]: pam_unix(sshd:session): session opened for user oracle by (uid=0)[END]"; Regard, Nikolay |
|
From: Сеньков Н. В. <n.s...@ze...> - 2018-11-15 17:06:50
|
Hello, colleagues. HIDS Control is display - HIDS service is DOWN. The try to start service don't change status service. Ossec server log: 2018/11/15 13:53:50 ossec-remoted(1213): WARN: Message from '172.20.75.104' not allowed. 2018/11/15 13:53:53 ossec-testrule: INFO: Reading decoder file alienvault/decoders/decoder.xml. 2018/11/15 13:53:53 ossec-testrule: INFO: Started (pid: 7290). 2018/11/15 13:53:53 ossec-csyslogd: INFO: Remote syslog server not configured. Clean exit. 2018/11/15 13:53:53 ossec-maild: INFO: E-Mail notification disabled. Clean Exit. 2018/11/15 13:53:53 ossec-execd(1350): INFO: Active response disabled. Exiting. 2018/11/15 13:53:53 ossec-syscheckd(1701): WARN: No option provided for directories: '/etc,/usr/bin,/usr/sbin', ignoring it. 2018/11/15 13:53:53 ossec-syscheckd(1202): ERROR: Configuration error at '/var/ossec/etc/ossec.conf'. Exiting. 2018/11/15 13:53:53 ossec-syscheckd(1202): ERROR: Configuration error at '/var/ossec/etc/ossec.conf'. Exiting. Best regard, Nikolay Senkov |
|
From: Ganesh K. <gan...@gm...> - 2017-09-14 10:10:53
|
Hi Team, Hope everyone is doing good. I would like to know the things need to be checked or prerequisites that need to considered inorder to upgrade the Debian based OS where Alien vault has been installed. Regards, |
|
From: Helder N. <ma...@ch...> - 2014-02-13 20:21:29
|
Hey, I just signed the petition "Ministros do Tribunal Superior Eleitoral: Aceite Certidões Cíveis no registro de candidaturas para as Eleições de 2014" and wanted to see if you could help by adding your name. Our goal is to reach 35,000 signatures and we need more support. You can read more and sign the petition here: https://www.change.org/petitions/ministros-do-tribunal-superior-eleitoral-aceite-certid%C3%B5es-c%C3%ADveis-no-registro-de-candidaturas-para-as-elei%C3%A7%C3%B5es-de-2014?recruiter=58451000&utm_source=share_petition&utm_medium=email&utm_campaign=petition_invitation Thanks! Helder Você está recebendo esta mensagem porque Helder Nascimento te enviou um email pela ferramenta de compartilhamento de abaixo-assinados da Change.org. A Change.org não armazenou seu endereço de email. Se você acha que este email foi enviado por engano, responda diretamente a Helder Nascimento no email hel...@gm.... |
|
From: Kaushal S. <kau...@gm...> - 2012-10-13 10:11:22
|
Hi, We have Dell R720 2U Rack Server in one of our DC. During installation, OSSIM Installer (http://communities.alienvault.com/community/download_64.html) does not detect the RAID Controller Card and NIC Card (Ethernet Card). Details of lspci command -> http://paste.debian.net/199820/ RAID Controller and NIC Card are detailed in -> http://www.dell.com/downloads/global/products/pedge/dell-poweredge-r720-spec-sheet.pdf Please let me know if any one needs more information. Regards, Kaushal |
|
From: amine a. <mas...@gm...> - 2012-01-30 09:54:47
|
mas...@gm... |
|
From: Kaushal S. <kau...@gm...> - 2011-01-13 00:49:39
|
Hi, I am using Analysis -> Vulnerabilties -> Scan Jobs and running the default Test for a gateway server which has public IP . I get "Timeout Expired" Please suggest/guide. Thanks Kaushal |
|
From: Pablo H. <pab...@pe...> - 2010-11-18 17:49:53
|
[ I hope this is still the correct mailinglist (as there is no traffic at all - but on contrib there is even _less_ traffic). ] Hi everybody! I am trying to build packages for Ubuntu. Is there a particular reason why such packages do not yet exist? Anyway, while building from source I noticed some things. I compiled the binaries the "Debian way" (ie. Using dpkg-buildpackage resp. debuild) and everything worked fine. You need to install the following packages: libglib2.0-dev libgda2-dev libgnet-dev python-all-dev dpatch libssl-dev uuid-dev As a result I now have the following files in my source directory: .git os-sim ossim_2.3.1-9_all.deb ossim_2.3.1-9.dsc ossim_2.3.1-9_i386.build ossim_2.3.1-9_i386.changes ossim_2.3.1-9.tar.gz ossim-contrib_2.3.1-9_all.deb ossim-framework_2.3.1-9_all.deb ossim-framework-daemon_2.3.1-9_all.deb ossim-mysql_2.3.1-9_all.deb ossim-server_2.3.1-9_i386.deb ossim-utils_2.3.1-9_all.deb README I will test them, rebuild for 64-bit and let you know. Now, my questions/considerations: First, is the old cvs-repository still available? I would like to compare the git-repo with the old sources. Second, the debian/changelog needs to be adopted to the correct syntax. How do you usually build .deb packages? [Two blanks before the date and just one before the author!] Third, are those sources different from those used for AlienVault Professional. Does anyone know? Fourth, is there a special reason why your OSSIM-packages are not part of the official Debian GNU/Linux release? Fifth, do you use an automated build daemon? Thank you for your work and best regards, Pablo |
|
From: Aro R. <ra...@ho...> - 2010-08-25 13:45:29
|
Hello, My project at university is about compiling and running OSSIM. I must compile OSSIM source code on Debian lenny. But the doc version is old. the last update was in 2004 ... So many patch failed ( for example I cannot patch snort with ossim patch. It fails ). is there a recent doc ( 2009 - 2010 ) about ossim installation. Otherwise what can I do ? ( my teacher do not want I make "lazy install" ( using debian package provided by alienvault ) Thanks for your help > From: os-...@li... > Subject: Os-sim-support Digest, Vol 35, Issue 1 > To: os-...@li... > Date: Wed, 28 Jul 2010 18:56:33 +0000 > > Send Os-sim-support mailing list submissions to > os-...@li... > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.sourceforge.net/lists/listinfo/os-sim-support > or, via email, send a message with subject or body 'help' to > os-...@li... > > You can reach the person managing the list at > os-...@li... > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Os-sim-support digest..." > > > Today's Topics: > > 1. Problem with Cisco Pix (Houcem HACHICHA) > 2. ossim agent does not receive traffic (Aro RANAIVONDRAMBOLA) > 3. OSSIM Source Code / Web Site (Aro RANAIVONDRAMBOLA) > 4. Re: OSSIM Source Code / Web Site (Ritter, Nicholas) > 5. Re: OSSIM Source Code / Web Site (Pablo) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 23 Jun 2010 20:01:34 +0100 > From: Houcem HACHICHA <hou...@gm...> > Subject: [Os-sim-support] Problem with Cisco Pix > To: os-...@li... > Message-ID: > <AAN...@ma...> > Content-Type: text/plain; charset="iso-8859-1" > > Hi guys, > > I performed a OSSIM 2.2 fresh installation, with no cards at promisc mode. I > needed to feed it with CISCO PIX logs. > So I redirected those logs using syslog (UDP:514), to the ossim server I > just installed. Running TCPdump on the server shows that those logs are > indeed recieved by the OSSIM server. I activated cisco-pix pluguin using > (only) ossim-setup on the server side. > > Back to the web frontend, events from CISCO-Pics are not pouring in :( > > Am I missing something here? Does the plugin need more configuration? Do I > need to send the syslog traffic throught another port/protocol? Do I need to > add the CISCO Pix to the assets list or something? > > > Please help > -- > Kind regards > > Houcem HACHICHA > -------------- next part -------------- > An HTML attachment was scrubbed... > > ------------------------------ > > Message: 2 > Date: Fri, 25 Jun 2010 10:51:40 +0200 > From: Aro RANAIVONDRAMBOLA <ra...@ho...> > Subject: [Os-sim-support] ossim agent does not receive traffic > To: <os-...@li...> > Message-ID: <BAY...@ph...l> > Content-Type: text/plain; charset="iso-8859-1" > > > > Hi, > I installed ossim-server and ossim-agent on a host A and I installed snare ( a sensor ) on a host B. A and B are linked by a SWITCH. > the problem : the agent which is on A does not receive the traffic ( the events ) from host B. > thanks for your help > > > _________________________________________________________________ > Vous voulez regarder la TV directement depuis votre PC ? C'est tr?s simple avec Windows 7 > http://clk.atdmt.com/FRM/go/229960614/direct/01/ > -------------- next part -------------- > An HTML attachment was scrubbed... > > ------------------------------ > > Message: 3 > Date: Wed, 28 Jul 2010 17:59:21 +0200 > From: Aro RANAIVONDRAMBOLA <ra...@ho...> > Subject: [Os-sim-support] OSSIM Source Code / Web Site > To: <os-...@li...> > Message-ID: <BAY...@ph...l> > Content-Type: text/plain; charset="iso-8859-1" > > > Hello, > - I would like to know if there is still a web site for OSSIM Project. When I go to www.ossim.net, I am rederected to Alienvault web site. > - Where can I obtain OSSIM Source Code ? > > Regards, > > razuki. > > -------------- next part -------------- > An HTML attachment was scrubbed... > > ------------------------------ > > Message: 4 > Date: Wed, 28 Jul 2010 11:12:44 -0500 > From: "Ritter, Nicholas" <Nic...@am...> > Subject: Re: [Os-sim-support] OSSIM Source Code / Web Site > To: "Aro RANAIVONDRAMBOLA" <ra...@ho...> > Cc: os-...@li... > Message-ID: <A31...@ma...v> > Content-Type: text/plain; charset="us-ascii" > > OSSIM is made by AlienVault. The code is available, I think, try looking > on the forums for info on how it is available. Try the following urls: > > > > For the Forums: > > > > https://www.alienvault.com/forum/ > > > > or the source git repo: > > > > http://www.assembla.com/code/os-sim/git/nodes?rev=master > > > > > > > > From: Aro RANAIVONDRAMBOLA [mailto:ra...@ho...] > Sent: Wednesday, July 28, 2010 10:59 AM > To: os-...@li... > Subject: [Os-sim-support] OSSIM Source Code / Web Site > > > > Hello, > - I would like to know if there is still a web site for OSSIM Project. > When I go to www.ossim.net, I am rederected to Alienvault web site. > - Where can I obtain OSSIM Source Code ? > > Regards, > > razuki. > > -------------- next part -------------- > An HTML attachment was scrubbed... > > ------------------------------ > > Message: 5 > Date: Wed, 28 Jul 2010 20:56:03 +0200 > From: Pablo <pa...@os...> > Subject: Re: [Os-sim-support] OSSIM Source Code / Web Site > To: "Ritter, Nicholas" <Nic...@am...> > Cc: Aro RANAIVONDRAMBOLA <ra...@ho...>, > os-...@li... > Message-ID: > <AANLkTi=zRSaUpZhc2BeWvEMyJDY_PYXhquHG=a1...@ma...> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, now they have a git at assembla: > http://www.assembla.com/code/os-sim/git/nodes?rev=master > > 2010/7/28 Ritter, Nicholas <Nic...@am...> > > > OSSIM is made by AlienVault. The code is available, I think, try looking > > on the forums for info on how it is available. Try the following urls: > > > > > > > > For the Forums: > > > > > > > > https://www.alienvault.com/forum/ > > > > > > > > or the source git repo: > > > > > > > > http://www.assembla.com/code/os-sim/git/nodes?rev=master > > > > > > > > > > > > > > > > *From:* Aro RANAIVONDRAMBOLA [mailto:ra...@ho...] > > *Sent:* Wednesday, July 28, 2010 10:59 AM > > *To:* os-...@li... > > *Subject:* [Os-sim-support] OSSIM Source Code / Web Site > > > > > > > > Hello, > > - I would like to know if there is still a web site for OSSIM Project. When > > I go to www.ossim.net, I am rederected to Alienvault web site. > > - Where can I obtain OSSIM Source Code ? > > > > Regards, > > > > razuki. > > > > > > ------------------------------------------------------------------------------ > > The Palm PDK Hot Apps Program offers developers who use the > > Plug-In Development Kit to bring their C/C++ apps to Palm for a share > > of $1 Million in cash or HP Products. Visit us here for more details: > > http://p.sf.net/sfu/dev2dev-palm > > _______________________________________________ > > Os-sim-support mailing list > > Os-...@li... > > https://lists.sourceforge.net/lists/listinfo/os-sim-support > > > > > > > -- > Best regards, > -- > Pablo Rinc?n Crespo > Security researcher and developer > Open Information Security Foundation (OISF) > -------------- next part -------------- > An HTML attachment was scrubbed... > > ------------------------------ > > ------------------------------------------------------------------------------ > The Palm PDK Hot Apps Program offers developers who use the > Plug-In Development Kit to bring their C/C++ apps to Palm for a share > of $1 Million in cash or HP Products. Visit us here for more details: > http://p.sf.net/sfu/dev2dev-palm > > ------------------------------ > > _______________________________________________ > Os-sim-support mailing list > Os-...@li... > https://lists.sourceforge.net/lists/listinfo/os-sim-support > > > End of Os-sim-support Digest, Vol 35, Issue 1 > ********************************************* |
|
From: Austin G. S. <as...@ne...> - 2010-08-24 18:26:54
|
I am just curious about nagios configuration- Is it better to scan and let OSSIM import the hosts or is it okay to configure this package manually? I would prefer to configure manually if I have no control over the groups OSSIM creates. Thank you, Austin |
|
From: Austin G. S. <as...@ne...> - 2010-08-17 15:20:38
|
I have recently installed the latest version of 32 bit OSSIM from the ISO available for download from the main site. After 3 downloads and 4 installs, it appears the ossim install is is not being setup correctly. To note, on the install, the partitioning screen kept looping and would not let us get past that step. Even after deleting, recreating, auto creation or anything. Only a custom install will get OSSIM installed. After installation, the web interface is not available, however Apache is installed. When running ossim-reconfig, I receive the following error: ln: creating symbolic link `/usr/share/ossim/www/conf/index.php': No such file or directory Error open log file No such file or directory at /usr/bin/ossim-reconfig line 2039. The /usr/share/ossim/www directory exists, however conf does not. It appears something is wrong with the iso / installation process. Is there a known work around? I would really love to get the latest version up and running... Thank you, Austin Smith |
|
From: Helder <hel...@gm...> - 2010-08-16 17:48:38
|
Hi I would like to learn how to customize better my dashboard in OSSIM. Anyone has some manual? Thanks -- Helder "O destino não é uma questão de sorte, é uma questão de escolha; Não é algo a se esperar, é algo a se conquistar" - William Jennings Bryan |
|
From: Aro R. <ra...@ho...> - 2010-08-13 16:31:53
|
Hello, I retrieved source code of ossim from here http://www.assembla.com/code/os-sim/git/nodes?rev=master I would like to run it on CentOS. But I am confused. I did not find a clear Documentation about how to configure, compile and run the program. I tried ./configure but the file does not exist. Could someone send me a doc or the steps to install the solution. I do not know how starting installation and configuration ... Regards, razuki |
|
From: Aro R. <ra...@ho...> - 2010-08-06 14:33:45
|
Hello, When I type the "cat syslog" command, I see syslog only contains one type of iptables'log, which is SRC=127.0.0.1 and DEST=127.0.0.1. It does not contain others logs that I made with iptables rules ( deny ouput packet for example : iptables -A OUTPUT -j DROP, then : iptables -t filter -A OUTPUT -j LOG --log-level 4). What I have to do so that I can read all iptables' event I made. Thanks for your help, ikuzar |
|
From: Aro R. <ra...@ho...> - 2010-08-03 15:21:22
|
Hello everybody, I would like to know if : - communication between elements can be encrypted now ? - there is authentication between agent server ? - external storage ( NAS / SAN / other ... ) is possible ? - there is a timestamp ? Thanks for your help, ikuzar |
|
From: Aro R. <ra...@ho...> - 2010-07-29 12:55:12
|
Hi, I found in the documentation that "Agent" is hosted in the sensor, while "collector" in Server. On the one hand, The documentation show that Agent makes "collecting" operation and normalize information before sending it to the server. On the other hand, it says that "collector" makes the normalization operation. -- Does both make the normalization ? -- I do not find any explanation about Normalization in the documentation, could you tell me where can I get it ? Thanks for your help, razuki. |
|
From: Pablo <pa...@os...> - 2010-07-28 18:56:32
|
Hi, now they have a git at assembla: http://www.assembla.com/code/os-sim/git/nodes?rev=master 2010/7/28 Ritter, Nicholas <Nic...@am...> > OSSIM is made by AlienVault. The code is available, I think, try looking > on the forums for info on how it is available. Try the following urls: > > > > For the Forums: > > > > https://www.alienvault.com/forum/ > > > > or the source git repo: > > > > http://www.assembla.com/code/os-sim/git/nodes?rev=master > > > > > > > > *From:* Aro RANAIVONDRAMBOLA [mailto:ra...@ho...] > *Sent:* Wednesday, July 28, 2010 10:59 AM > *To:* os-...@li... > *Subject:* [Os-sim-support] OSSIM Source Code / Web Site > > > > Hello, > - I would like to know if there is still a web site for OSSIM Project. When > I go to www.ossim.net, I am rederected to Alienvault web site. > - Where can I obtain OSSIM Source Code ? > > Regards, > > razuki. > > > ------------------------------------------------------------------------------ > The Palm PDK Hot Apps Program offers developers who use the > Plug-In Development Kit to bring their C/C++ apps to Palm for a share > of $1 Million in cash or HP Products. Visit us here for more details: > http://p.sf.net/sfu/dev2dev-palm > _______________________________________________ > Os-sim-support mailing list > Os-...@li... > https://lists.sourceforge.net/lists/listinfo/os-sim-support > > -- Best regards, -- Pablo Rincón Crespo Security researcher and developer Open Information Security Foundation (OISF) |
|
From: Ritter, N. <Nic...@am...> - 2010-07-28 16:12:55
|
OSSIM is made by AlienVault. The code is available, I think, try looking on the forums for info on how it is available. Try the following urls: For the Forums: https://www.alienvault.com/forum/ or the source git repo: http://www.assembla.com/code/os-sim/git/nodes?rev=master From: Aro RANAIVONDRAMBOLA [mailto:ra...@ho...] Sent: Wednesday, July 28, 2010 10:59 AM To: os-...@li... Subject: [Os-sim-support] OSSIM Source Code / Web Site Hello, - I would like to know if there is still a web site for OSSIM Project. When I go to www.ossim.net, I am rederected to Alienvault web site. - Where can I obtain OSSIM Source Code ? Regards, razuki. |
|
From: Aro R. <ra...@ho...> - 2010-07-28 15:59:29
|
Hello, - I would like to know if there is still a web site for OSSIM Project. When I go to www.ossim.net, I am rederected to Alienvault web site. - Where can I obtain OSSIM Source Code ? Regards, razuki. |
|
From: Aro R. <ra...@ho...> - 2010-06-25 08:51:46
|
Hi, I installed ossim-server and ossim-agent on a host A and I installed snare ( a sensor ) on a host B. A and B are linked by a SWITCH. the problem : the agent which is on A does not receive the traffic ( the events ) from host B. thanks for your help _________________________________________________________________ Vous voulez regarder la TV directement depuis votre PC ? C'est très simple avec Windows 7 http://clk.atdmt.com/FRM/go/229960614/direct/01/ |
|
From: Houcem H. <hou...@gm...> - 2010-06-23 19:01:42
|
Hi guys, I performed a OSSIM 2.2 fresh installation, with no cards at promisc mode. I needed to feed it with CISCO PIX logs. So I redirected those logs using syslog (UDP:514), to the ossim server I just installed. Running TCPdump on the server shows that those logs are indeed recieved by the OSSIM server. I activated cisco-pix pluguin using (only) ossim-setup on the server side. Back to the web frontend, events from CISCO-Pics are not pouring in :( Am I missing something here? Does the plugin need more configuration? Do I need to send the syslog traffic throught another port/protocol? Do I need to add the CISCO Pix to the assets list or something? Please help -- Kind regards Houcem HACHICHA |
9 messages has been excluded from this view by a project administrator.
