Tutorial 7: Feature highlight / pre-tutorial on Risk Maps
Wed, 15 Oct 2008

Introduction

Today I would to share something interesting we're working on: Risk/Availability/Vulnerability indicator Maps.

The purpose was to fit the most important information that can be gained from ossim all over it's interface, into a simple to use, simple to manage and simple to analyze interface.
We already had an approach to both, to using maps (images) and to aggregate/organize different input into meta-objets (what we called business processes). But, both of them had the same problem: they were complex and they were ugly.



::read more

posted at: 14:26 | path: /ossim/tutorials | permanent link to this entry | 1 comments |
Tags: , , ,



Documentation Overhaul
Thu, 02 Oct 2008

Just a quick note to throw some attention at the major changes we are making to the OSSIM documentation section.

We're sort-of hiding deprecated or non-important documentation, reorganizing existing one and releasing new stuff such as configuration instructions forthird party devices.

Enjoy :-)

posted at: 08:35 | path: /ossim | permanent link to this entry | 1 comments |
Tags: ,



Office pics update
Wed, 13 Aug 2008

Remember the pictures I posted some months ago while we were moving in ? Well, office looks much better now, so I decided to bring the cam along and take some pictures. Our office is situated between two emblematic building in Madrid, the Torres Blancas and the Puerta de America hotel.

AV Office 2008/08

In the meantime we're still working on the 1.0.6 updater, which will feature, among others:

  • Antivirus (clamav)
  • Mod-security
  • GLPI
  • The new nessus feed
  • System upgrade
  • Security fixes
  • Automatic Nagios config
  • Bugfixes and more...
  • The directive editor and reporting probably won't make it into this release, since we want to release before we merge all of the GSoC 2008 data into the main CVS.

    posted at: 08:18 | path: /ossim | permanent link to this entry | 1 comments |
    Tags: ,



    Status update & News
    Tue, 05 Aug 2008

    Back with a quick status update. I hope this will be the last "misc" message in a while, so I can start uploading useful content again.

    First of all, I hope everything's having a nice summer (or winter ;-)). I had my small share of holiday too, and expect to have another week of two during the next months.


    ::read more

    posted at: 12:27 | path: /ossim | permanent link to this entry | 1 comments |
    Tags: , , , , ,



    An alternative solution to Tenable's Nessus Feed licensing issues
    Tue, 05 Aug 2008

    We've decided to start working on an alternative feed for Nessus after Tenable having changed licensing again.

    Excluding even non-profit organizations and testing purposes completely from the feed seems contrary to the open source spirits, so we'll be investing a considerable amount of effort and money into providing a high quality feed for everyone.

    The final workings of it is still unclear, but we're aiming at the Sourcefire model: if you subscribe you'll get them instantly, everybody else gets them with a slight delay (we're discussing a one to four week delay).

    One of the goals we've got is getting a good bunch of people interested on this and willing to participate (sort of a Consortium maybe, although we're starting it internally right now) so if you could please share this with people who could have the skill/knowledge to contribute to this, I'd be more than grateful.

    Last but not least we're looking into a way of ensuring that the effort put into this by everyone won't be abused in any ways, so if anybody has got suggestions about model/licensing/etc it would be great to hear them.

    Edit: Due to licensing warnings from Tenable I had to rewrite some terminology.



    posted at: 06:24 | path: /ossim | permanent link to this entry | 0 comments |
    Tags: , , , ,



    New Forums
    Thu, 15 May 2008

    I'm proud to announce the avilability of our brand new forum infrastructure. We were getting really tired in the end by the lack of features of the sf.net forums, so we decided to setup FUDForum on ossim.net

    I for myself am very motivated by this changes, I was getting crazy with the old environment and promised myselft to answer many more things on these new forums.
    Enjoy: ossim.net forums.

    posted at: 19:25 | path: /ossim | permanent link to this entry | 0 comments |
    Tags: , ,



    You are invited to take part in The Google Summer of Code(tm) 2008
    Mon, 17 Mar 2008

    Yay ! we're proud to announce that ossim has been chosen to take part int he google summer of code program. Brian, now it's your turn ;-).
    I'll post another entry when we've got more information about how this works.

    Congratulations!
    Your organization "OSSIM: Open Source Security Information Management" has been accepted in to the 
    Google Summer of Code(tm) 2008. You have been assigned as primary point of contact and as an 
    administrator for your organization.
    please visit http://code.google.com/soc/mentor_step1.html and sign up using your Google Account.
    Thanks.
    - Your friendly Google Summer of Code administrators
    

    posted at: 20:46 | path: /ossim | permanent link to this entry | 0 comments |
    Tags: , ,



    Forensic database performance optimizations
    Fri, 14 Mar 2008

    Remember the couple of posts I made back in November in the tuning section ? Well, I finally got the time to look into this issue again and have made some interesting discoveries the last couple of days. I'm really enjoying this.

    The following table illustrates some comparisons between a stock Base 1.3.9 (ossim patched) and the tuned rewrite I've got running right now. These optimizations are now part of our appliance offering (updates for already deployed ones on the way) and will be released to the public afterwards. Thanks to everybody that has been helping me on this, specially to the people at #ossim in freenode ;-).


    ::read more

    posted at: 09:10 | path: /ossim/tuning | permanent link to this entry | 0 comments |
    Tags: , , ,



    Tutorial 6: Plugin writing primer
    Tue, 11 Mar 2008

    A couple of days ago I was fixing the fortinet/fortigate with the kind help of a Swiss OSSIM user (thanks Mikael ;-) ) and I wrote this little piece of python in order to help me out with it. Now I'm using it a lot to debug plugins so I guess more people could benefit from this also :-)
    And well, I'll paste a sample plugin debugging session in order to give ideas.
    BTW, this assumes basic knowledge of regular expressions, check this Regexp Primer out if you want to refresh that knowledge. And BTW2, some log lines are broken for readability.



    ::read more

    posted at: 11:38 | path: /ossim/tutorials | permanent link to this entry | 2 comments |
    Tags: , ,



    User feedback
    Wed, 05 Mar 2008

    I wanted to point you at two things I think that are important, things that we've been neglecting in the past months.

    1. IRC Channel: we've ignored this way of communication for quite some time but enough of that, I added a "fire up BitchX" postit on my desk so from now on I'll spend as much time there as I can, and hopefully other ossim users / developers too. See you at irc.freenode.org, channel #ossim
    2. Bug tracking mechanism: honestly, I never liked the one provided by sf.net so I followed a suggestion from a friendly guy at #ossim and installed FlySpray as a bug tracking system. Check it out at http://www.ossim.net/bugs/ (Need to add the virtualhost for bugs.ossim.net :-) ).

    So, if you've got bugs or suggestions for ossim, please start posting them there. And if you just want to hang out with us join on the IRC nchannel.

    During the next days I'll post an update on currenct development, we're working on some exciting features right now ;-)

    posted at: 20:01 | path: /ossim | permanent link to this entry | 0 comments |
    Tags: , ,



    AlienVault OSSIM Installer 1.0.4 released
    Fri, 22 Feb 2008
    After having written the whole thing a reduced version for those with little time available seems in place.

    We've released OSSIM 0.9.9 this week, release which was followed by a post to BugTraq regarding some XSS and SQL vulnerabilities present on OSSIM.
    After having fixed those vulnerabilities we're now releasing:

    Upgrade is encouraged to all OSSIM users.


    ::read more

    posted at: 23:34 | path: /ossim/installer | permanent link to this entry | 0 comments |



    1.0.4 Installer / updater coming :-)
    Fri, 15 Feb 2008

    We're proud to announce the soon-to-be-available 1.0.4 installer (versioning wise it could be 1.1 or even higher because of all of the changes but, well, we called it 1.0.4), both as a standalone ISO image as well as the updater.

    We've been working very hard the past months on this, the updater has been a nightmare. It's much easier to make an installer than an updater...

    For those wanting to try it out, just download update.pl and run it on a 1.0 - 1.0.3 installed image (should work with the images we've released inbetween on the forums too). Be warned tho, we're still on final testing phases and there might be some issues in there, any sort of testing will be more than welcome.

    Basically the installer will backup all the databases and /etc/*, /usr/share/ossim*, install new packages (ossim 0.9.9), new deps (ossec, munin, fprobe) and tune some other things.
    Anyway, as said, there are backups and it shouldn't be too hard to get it back working if something fails.

    A few hints if you're going to try it out:

    • Default values for most of questions are fine. If unsure just press enter.
    • "auto" is the recommended way to go for new users, "expert" allows for a more fine grained setup.
    • We experienced occassional hangs at the munin plugin setup step. Had to kill the following process on another terminal in order to continue with the installation process
    • After everything has been installed you have to log in and upgrade the web part, it should work like a charm :-)
    • Right now requires internet access; we'll publish an offline updater too of course

    Check a sample installer output if you're curious.


    Get the 1.0.4 (beta) updater here.


    Here is a more detailed list of the most important changes:

    New software:

    • Included OSSEC (http://www.ossec.net/)
    • Included Munin for sensor monitorization (http://munin.projects.linpro.no/)
    • Included FProbe for high traffic environments (http://fprobe.sourceforge.net/)
    • OSSIM core upgrade
    • Included and updated bleeding snort rules

    New features:
    • Intrushield plugin
    • Ntop connections being rewritten through the server, no need to open port 3000 to then anymore.
    • Partitioning switched to manual on installation
    • Database optimization code included
    • Added some database indexes for query speedup
    • Updater support
    • Experimental agent event consolidation
    • Agent event statistics

    Updated features:
    • Updated realsecure/proventia plugin
    • Updated FW1 plugin
    • Update IIS plugin
    • Database types optimized
    • Updated pam_unix rules
    • Updated ssh rules
    • Updated cross correlation information

    Bugfixes
    • Localization now working
    • Fixed some server issues

    posted at: 20:52 | path: /ossim/installer | permanent link to this entry | 1 comments |
    Tags: ,



    Interesting log collection / SIM collection document
    Fri, 01 Feb 2008
    Just a short post pointing at a very interesting study published by the "Bundesamt fuer Sicherheit in der Informationstechnik" (part of the German Government dedicated to IT Security) about log analysis. Sadly it's in german and I don't know if they're going to translate it but I wanted to point at it since OSSIM is included as one of aprox fifteen products. Get it here.

    posted at: 15:35 | path: /ossim | permanent link to this entry | 1 comments |
    Tags: , ,



    OSSIM applied to ITIL
    Thu, 17 Jan 2008

    Recently I stumbled across an interesting article talking about Microsoft, Opensource and ITIL where ossim was being mentioned. (the article can also be found googling for "ossim itil microsoft" in case the link breaks).

    I've never been very keen about learning ITIL either (although I've heard about it everywhere during the last year) but this really caught my attention. In that paper ossim gets referenced only on the "security management" section, but I think that's mainly caused by ossim being hard to install, setup and understand when that article was written, so I thought I give it another try from my point of view, taking the included tools into account for the different ITIL sections.

    So, the goal of this article would be to extend and improve that other article, giving a thought about how I'd approach all those ITIL recommendations from an OSSIM point of view.

    The Information Technology Infrastructure Library is comprised by two main sets and a series of subsets (from what I've read on that article and the wikipedia):

    • Service Support
    • Service Delivery

    Note: The definitions after each topic have been quoted from the MS article since they're small and concise.



    ::read more

    posted at: 17:33 | path: /ossim | permanent link to this entry | 1 comments |
    Tags: ,



    Tutorial 5: Windows event logging
    Wed, 19 Dec 2007

    The windows event log

    As an introduction to windows event logging I recommend reading the following article: Monitoring and Troubleshooting Using Event Logs. It's the first interesting one I've found after googling for an introduction.

    Quoting the article, which also talks about EventCombMT.exe which we'll mention later:

    This article reviews best practices for working with Windows event logs including how to interpret 
    event messages, how to configure event logs, how to search and filter events, how to view events on 
    remote systems, and how to use EventCombMT.exe and other tools to monitor events on multiple systems.
    


    ::read more

    posted at: 15:54 | path: /ossim/tutorials | permanent link to this entry | 12 comments |
    Tags: , , , ,



    Tutorial 4: Correlation engine primer
    Mon, 10 Dec 2007

    Introduction

    In order to answer to a recent forum post I had to do a quick research since it had been some time since I last tested this.
    The exact question was:

    Hello,
    
    Is there a document talking about how the directives are processed?  One question
    that I have is if you have multiple directives created and an event comes in
    that matches the initial states of more than a single directive will both actually
    process the event, or only the first match (which I think is the case)?
    
    Thanks for any clarification you can provide.
    
    Stephen
    

    This post gives a bit of insight to how the correlation engine works and features some simple, custom made directives that help me answer that question.

    The test environment features two events belonging to the ssh plugin (plugin_id 4003):
    • SSH password failed (plugin_sid 1)
    • SSH password accepted (plugin_sid 7)
    In order to test this I've created three directives (plugin_id 1505)
    • Test directive 21, grouping one login failure and one success
    • Test directive 22, grouping one login failure and one success
    • Test directive 23, used in the second case, grouping those two
    So, with all of this in place it was easy to simulate this failing a login and succeeding afterwards.


    ::read more

    posted at: 12:47 | path: /ossim/tutorials | permanent link to this entry | 3 comments |
    Tags: , , ,



    Tutorial 3: First recommended steps after installation
    Fri, 07 Dec 2007

    This tutorial tries to show the first common steps you could perform if you're new to ossim and just finished installation, without knowing what to do next.
    The tutorial will cover:

    • Policies
    • Initial Inventory
    • Scans
    • Scheduled scans
    • What to do next
    Many topics we'll cover on this tutorial can be extended checking the documentation wiki.


    ::read more

    posted at: 16:53 | path: /ossim/tutorials | permanent link to this entry | 7 comments |
    Tags: , ,



    Tutorial 2: Syslog data mining with attached md5sum. AKA "Store 100% of data".
    Thu, 06 Dec 2007

    1. The need. The Hype.

    There's obviously a need for storing vast amount of logs, and few things today aren't able to log into syslog. So it's just obvious to stumble upon that request every once in a while, and this tutorial illustrates the OSSIM approach at massive syslog data storage. Of course, where you say syslog you can say windows event log, snmp data, whatever generates a big amount of raw data.

    Compliance

    I don't know much yet about all of this compliance stuff (I were lucky, Julio always has been much more knowledgeable on that area than me so I could skip it) but I guess I'll have to start learning, there are just too many people asking for it and I'm getting very curious.

    From what I've seen, a short list of regulations requiring, or at least strongly recommending a certain amount of raw data storage and reports are:
    • ISO27001/17799
    • SOX
    • HIPAA
    • PCI
    • Basel II
    • NIST 800-53
    • Many more...
    (Searching for SIM and compliance information I see that's a major marketing point from vendors too, well, just for the records, ossim helps you to be compliant with all that stuff)

    Centralized logging

    Maybe the need is pure sysadmin's lazyness. You want to be able to answer to questions you get asked by your management / customers in the easiest possible way.
    I heard this from a guy a couple of days ago: the more information about your network you've got, the more answers you can give, and that's exactly what SIM/SEM systems are good at.

    Data mining

    This is a bit redundant with the previous entry, but there are people that just don't care about exact data, but they're in desperate need of colorful graphs in order to be able to keep their bosses calm. Well, having logs from everything in your network allows for easy colorful report generation with little knowledge of the underlying data. The worthyness of those reports in the end will be highly questionable of course.


    ::read more

    posted at: 20:10 | path: /ossim/tutorials | permanent link to this entry | 11 comments |
    Tags: , , , , ,



    OSSIM Mobile now available ;-)
    Sat, 01 Dec 2007

    Well, kindof at least...

    Since Apple's iPhone is basically a stripped down MacosX and it has some nice toys to play with, I thought I'd give the provided python port a try and fire up the OSSIM agent. As expected everything worked like a charm and getting ossim up & running was very easy. Here is the rest of it.


    ::read more

    posted at: 18:43 | path: /ossim/plugins | permanent link to this entry | 3 comments |
    Tags: , , ,



    MySQL performance tuning applied to OSSIM. Case 1.
    Fri, 30 Nov 2007

    I'd like to share my first actual success on mysql tuning, after having spent a couple of days reading everything I could about the matter (and still waiting for the books to arrive).
    From what I've seen a very important point on DB optimization is the right table design, followed by the right queries and finally optimizing DB parameters. Since I don't know enough yet about optimal DB design I'll skip that phase (tho I'll definetively accomplish it during the next weeks/months) and examining some queries.

    After enabling log_slow_queries, one of the first queries popping out continuously was the following:

    SELECT *, inet_ntoa(src_ip) as aux_src_ip, inet_ntoa(dst_ip) as aux_dst_ip FROM event_tmp order by id desc limit 1;
    
    Ugly, ain't it ?

    ::read more

    posted at: 11:45 | path: /ossim/tuning | permanent link to this entry | 1 comments |
    Tags: , ,



    Categories

    / (37)
        code/ (1)
        feed/ (1)
        ossim/ (24)
            installer/ (3)
            plugins/ (2)
            tuning/ (3)
            tutorials/ (7)
        personal/ (10)
            campus/ (2)
            opinion/ (1)
            travel/ (1)
        rants/ (1)




    RSS




    < October 2008 >
    MoTuWeThFrSaSu
       1 2 3 4 5
    6 7 8 9101112
    13141516171819
    20212223242526
    2728293031  




    Archives

    2008-Dec
    2008-Oct
    2008-Aug
    2008-Jul
    2008-May
    2008-Mar
    2008-Feb
    2008-Jan
    2007-Dec
    2007-Nov




    Tags




    Made with PyBlosxom