ossim - AlienVault

The following figure shows how the properties mentioned above are affected by these
processes:
II. Post-processing
Prioritization
Risk assessment
Correlation
Processing
Assess the threat by
contextualizing an event
Assess the risk in relation
to the value of assets
Compare various events
to obtain more valuable
information
Effect
Improves reliability
Improves reliability
Improves reliability, sensitivity,
and abstraction
So after processing them, our system will use the alerts provided by detectors to produce what
will be referred to in this document as alarms.
An alarm will usually be the result of various alerts and have a higher level of abstraction that
allows us to identify more complex patterns—and it will provide better reliability.
The Detection Map
With the goal of defining detection capability, OSSIM will develop a detection map, which will
involve categorizing the possibilities in the detection of attacks and security events.
Auditing Detection Capability
Using this detection map we will be able to define a new auditing method that will allow us to
measure the situation and needs of an organization in relation to the effectiveness of its
detection systems when an attack is in place.
This perspective is very different from the traditional audit or intrusion test, since we are
interested not in locating security failures but in the capability to detect the eventual exploitation
of these failures.
In this project we will therefore develop a Detection Capability Auditing Procedure with which we
will provide a mechanism for assessing an organization’s situation in relation to its capacity for
detecting attacks.
10