Building Collector Plugins 1.1 - AlienVault

More documents

Recommendations

Info

Building Collector Plugins - Admin Guide 4) Save & Exit 5.2.9 Register the Plugin with the OSSIM Server Copy an existing SQL script to build the new one on the existing structure opensourcesim:/usr/share/doc/ossim-mysql/contrib/plugins# cp syslog.sql example.sql Get a list of the rules defined in the Plugin configuration file. opensourcesim:~# grep '^\[' /etc/ossim/agent/plugins/example.cfg [Rule 01 - Console Session Open] [Rule 02 - Console Session Closed] [Rule 03 - New User Session - IP] [Rule 04 - New User Session - hostname] [Rule 05 - User Session Closed - IP] [Rule 06 - User Session Closed - hostname] [Rule 07 - Reboot Detected] [Rule 99 - Catch all] Rules having the same plugin_sid will only require one SQL statement and plugin_sid defined on the OSSIM server. Different rules where used just because both IP addresses and hostnames are returned as sources by the “last” command. -- plugin_id: 9001 DELETE FROM plugin WHERE id = "9001"; DELETE FROM plugin_sid where plugin_id = "9001"; INSERT INTO plugin (id, type, name, description) VALUES (9001, 1, 'Example', 'User logons based on the last output'); INSERT INTO plugin_sid (plugin_id, sid, category_id, class_id, name, priority, reliability) VALUES (9001, 1, NULL, NULL, 'Login: System console' , 5, 5); INSERT INTO plugin_sid (plugin_id, sid, category_id, class_id, name, priority, reliability) VALUES (9001, 2, NULL, NULL, 'Logout: System console' , 5, 5); INSERT INTO plugin_sid (plugin_id, sid, category_id, class_id, name, priority, reliability) VALUES (9001, 3, NULL, NULL, 'Login: Pseudo terminal' , 3, 5); INSERT INTO plugin_sid (plugin_id, sid, category_id, class_id, name, priority, reliability) VALUES (9001, 4, NULL, NULL, 'Logout: Pseudo terminal' , 3, 5); INSERT INTO plugin_sid (plugin_id, sid, category_id, class_id, name, priority, reliability) VALUES (9001, 5, NULL, NULL, 'System reboot: Restarted' , 5, 5); INSERT INTO plugin_sid (plugin_id, sid, category_id, class_id, name, priority, reliability) VALUES (9001, 99, NULL, NULL, 'Last: Generic messages' , 1, 1); After changing the script to reflect the Plugin IDs and SIDs, load the changes with the command: opensourcesim:/usr/share/doc/ossim-mysql/contrib/plugins# cat example.sql | ossim-db Page 30 Copyright © Alienvault 2010
5.2.10 Check whether the plugin was successfully registered Building Collector Plugins - Admin Guide Plugin ID Plugin SIDs 5.2.11 Restart the OSSIM Server opensourcesim:~# /etc/init.d/ossim-server restart 5.2.12 Restart the OSSIM Agent opensourcesim:~# /etc/init.d/ossim-agent restart Page 31 Copyright © Alienvault 2010
Page 1 and 2: Building Collector Plugins Admin Gu
Page 3 and 4: Building Collector Plugins - Admin
Page 29: Building Collector Plugins - Admin

Building Collector Plugins 1.1 - AlienVault

Create successful ePaper yourself

Delete template?

Save as template?