ossim - AlienVault

3.6.2.2 Method 2: Correlation Using Sequences of Events
The Sequences Panel
The basic idea for detecting a sequence of patterns is simple: just create a list of rules like “if
you receive event A and then B and then C, perform action D.”
To that end we use the sequences panel, where we define lists of rules for each sequence of
events that we want to define.
The complexity of the panel depends on the capacity of those rules for abstraction and OSSIM’s
ability to analyze a variety of input.
Our panel can execute sequences with the following characteristics:
• Ability to define variable origins and destinations
• Accept both pattern input from detectors and indicator input from monitors
• Define the priority and reliability of new alerts
• Use “elastic” variables, or variables that can measure an event to define priority or
reliability (e.g. total denial of service -> high priority, 50% denial -> medium priority, 15%
denial -> low priority)
• Recursive architecture—we can create objects by correlating rules that function as
detectors or monitors in new rules
19