Jaime Blasco Blog

I īve just updated ossim Cross Correlation rules related to nessus-snort, check the cvs!!
So, the basic rule for Cross Correlation is: 
if snort has discovered an attack to an IP, and we know that IP has that vulnerability, the reliability will change to 10.
The relationships between nessus ID.s and snort vulnerabilities are stored in the table plugin_reference. 
If you want to do some kind of personalization, you have to insert data in this table. Check Personalize Cross Correlation. 
When a personalized Cross Correlation matches, the event adds the reliability of the new plugin to the old one. 



  posted at: 14:59 | path: /Ossim | permanent link to this entry | 0 comments |