Building Collector Plugins 1.1 - AlienVault

Building Collector Plugins - Admin Guide
1.3 The Configuration Workflow
o
Collect a Log Sample
First thing to start with is checking which log messages the application generates and eventually
identify sets of logs having a similar structure. Those logs having a similar structure will be where
possible covered by a single collector rule.
o
Create a Plugin File
Best is to copy one existing file and modify its content to match the new application. Should a plugin
exist for a similar application, it is recommended to copy such a file, as there is a good chance that
rules have a similar content and are grouped in a similar way - a generic HTTP-Proxy log will always
contain a URL, a generic Firewall log will contain a Source IP Address and Source Port as well as a
Destination IP Address and Destination Port. Some user defined fields might be defined for a specific
application and the correlation at the server level can be simplified if similar applications use the
same user defined fields.
o
Define a Generic Rule
This is the last Rule to evaluate, which catches all the events that cannot be grouped under specific
rules.
o
Define Specific Rules
The Specific rules are defined for specific error conditions or categories of events. There might also
be that one single rule is used to generate different types or subtypes of events.
o
Discard Noise
Events that are considered noise can be discarded by OSSIM by excluding certain event subtypes
(Plugin_SIDs) in the plugin file, by the way the regular expressions are defined or by using policies.
However, the best way to discard events is by filtering them on the monitored device or at syslog
level on the host running the OSSIM Agent.
o
Review the Evaluation Order
The rules are evaluated alphabetically, which means that all it counts is the name of a rule and not
the position in the plug-in file. The Generic Rule might even be on the first position if the name is
properly chosen. Having rules alphabetically placed after the Generic Rule will have as effect that
the corresponding logs will be evaluated as generic events instead of having the proper event type
and subtype assigned.
o
Register the Plugin with the OSSIM Agent
In order to have a Plugin activated and sending events to the OSSIM server, the path to the plugin file
has to be specified in the Agent configuration file.
Page 8 Copyright © Alienvault 2010