ossim - AlienVault

More documents

Recommendations

Info

Team The current development team for the project is: Dominique Karg, Jesús D. Muñoz, David Gil, Fabio Ospitia Santiago González, Julio Casal, Technical Director Documentation Development Development Software Integration Coordinator 2
Index Foreword ....................................................................................................................... 4 1. Introduction ............................................................................................................ 5 1.1. Introduction .................................................................................................... 5 1.2. What is OSSIM? ............................................................................................ 6 1.3. Open Source Infrastructure for Security Monitoring ...................... 7 2. The Detection Process ........................................................................................ 8 3. Functionality ......................................................................................................... 11 3.1 Pattern Detectors......................................................................................... 11 3.2 Anomaly Detectors ...................................................................................... 12 3.3 Centralization and Normalization .......................................................... 13 3.4 Prioritization................................................................................................... 14 3.5 Risk Assessment........................................................................................... 15 3.6 Correlation ...................................................................................................... 16 3.6.1 Correlation Model................................................................................. 16 3.6.2 Correlation Methods............................................................................ 17 3.6.3 Levels of Correlation........................................................................... 20 3.7 Monitors........................................................................................................... 23 3.8 Forensic Console .......................................................................................... 24 3.9 Control Panel ................................................................................................. 24 4. Architecture .......................................................................................................... 26 4.1. General Architecture ................................................................................. 26 4.2 Data Flow ........................................................................................................ 27 4.3 Distribution Architecture ........................................................................... 29 Contact......................................................................................................................... 30 3
Page 1: OSSIM Open Source Security Informat
Page 5 and 6: 1. Introduction 1.1. Introduction W
Page 7 and 8: 1.3. Open Source Infrastructure for
Page 9 and 10: The following table summarizes thes
Page 11 and 12: 3. Functionality In order to unders
Page 13 and 14: 3.3 Centralization and Normalizatio
Page 15 and 16: 3.5 Risk Assessment The importance
Page 17 and 18: 3.6.2 Correlation Methods To achiev
Page 19 and 20: 3.6.2.2 Method 2: Correlation Using
Page 21 and 22: Detection of a connect operation is
Page 23 and 24: 3.7 Monitors Although they are simp
Page 25 and 26: The control panel is our general th
Page 27 and 28: 4.2 Data Flow To give a better unde
Page 29 and 30: 4.3 Distribution Architecture OSSIM

ossim - AlienVault

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?