Building Collector Plugins 1.1 - AlienVault

Building Collector Plugins - Admin Guide
1.2 OSSIM Server Role
1.2.1 Event Enrichment
The OSSIM server enriches the received normalized event with the metadata stored in the OSSIM
Database.
o
Enriched Event
The OSSIM Server enriches the event with the Priority and Reliability values, which are
specific to the event type (plugin_id) and subtype (plugin_sid), as well as with the Asset
Value which is specific to the Source (asset_src) and the Destination (asset_dst) hosts.
Example:
ossim:/var/log/ossim/server.log:
2010-05-30 06:48:41 OSSIM-Message: Event received: event id="0" alarm="0"
type="detector" fdate="2010-05-30 13:15:52" date="1275239752" tzone="0"
plugin_id="4003" plugin_sid="7" src_ip="192.168.178.20" src_port="4445"
dst_ip="192.168.178.200" dst_port="22" sensor="192.168.178.201" interface="eth0"
protocol="TCP" asset_src="2" asset_dst="2" log="May 30 13:15:52 dmz01
sshd[12980]: Accepted password for root from 192.168.178.20 port 4445 ssh2"
username="root"
o
Priority
The priority is related to threats and it reflects the importance of a specific attack, having
nothing to do with a specific host or environment. It only measures the relative importance
of the attack itself.
Range: 0 - 5
Default value: 1
Example:
A Unix server running Samba gets attacked by the Sasser worm .
Apart from the fact that the attack won’t have an impact on the given environment, it
has the potential to exploit a big security hole and for that reason the priority is
considered as being high.
o
Reliability
Classical risk-assessment would refer it as "probability ". Since it's quite difficult to
determine how probable it is for a network to be exposed to certain vulnerabilities, the IDS
related “reliability” approach was considered more appropriate.
Range: 0 - 10
Default value : 1.
Example:
If a host connects to 5 different hosts in the same subnet using port 445, could be a
normal behavior, unreliable for IDS purposes. If connecting to 15 hosts would be
Page 6 Copyright © Alienvault 2010