ossim - AlienVault

Index
Foreword ....................................................................................................................... 4
1. Introduction ............................................................................................................ 5
1.1. Introduction .................................................................................................... 5
1.2. What is OSSIM? ............................................................................................ 6
1.3. Open Source Infrastructure for Security Monitoring ...................... 7
2. The Detection Process ........................................................................................ 8
3. Functionality ......................................................................................................... 11
3.1 Pattern Detectors......................................................................................... 11
3.2 Anomaly Detectors ...................................................................................... 12
3.3 Centralization and Normalization .......................................................... 13
3.4 Prioritization................................................................................................... 14
3.5 Risk Assessment........................................................................................... 15
3.6 Correlation ...................................................................................................... 16
3.6.1 Correlation Model................................................................................. 16
3.6.2 Correlation Methods............................................................................ 17
3.6.3 Levels of Correlation........................................................................... 20
3.7 Monitors........................................................................................................... 23
3.8 Forensic Console .......................................................................................... 24
3.9 Control Panel ................................................................................................. 24
4. Architecture .......................................................................................................... 26
4.1. General Architecture ................................................................................. 26
4.2 Data Flow ........................................................................................................ 27
4.3 Distribution Architecture ........................................................................... 29
Contact......................................................................................................................... 30
3