Documentation Center
AlienVault® USM Appliance™

Configure Database Plugins

Applies to Product: USM Appliance™ AlienVault OSSIM®

Database plugins extract data from an external database and turn them into Events. USM Appliance supports MySQL and Microsoft SQL Server.

The database plugin configuration file provides information on how USM Appliance should connect to and query the database.

Anatomy of the Plugin Configuration File

See below for a description of various sections in the database plugin configuration file above.

Modify the Plugin Configuration File

Before modifying the plugin configuration file, you must first obtain the IP address, port number, and an authenticated user account of your database.

Warning: For Microsoft SQL Servers, you must use SQL Server Authentication. You will receive a "Connection refused" error if you use Windows Authentication instead.

This task enables communication with the external database from which the plugin receives data. You will need command line access to USM Appliance to complete this task.

To configure communication with an external database

  1. Connect to the AlienVault Console through SSH and use your credentials to log in.

    The AlienVault Setup menu displays.

  2. On the AlienVault Setup main menu, select Jailbreak System to gain command line access.

    Select Yes when prompted. You will be in the root directory.

  3. Create the file /etc/ossim/agent/plugins/<database-plugin>.cfg.local.

    For example, to configure the mcafee-epo plugin, you need to create the mcafee-epo.cfg.local file.

  4. In the .local file, add the fields shown below and replace the angle bracket part (including the brackets) with your database settings.

    [config]

    source_ip=<database_IP>

    source_port=<database_port>

    user=<username>

    password=<user_password>

    db=<database_name>

    sleep=<number_of_seconds_between_sending_queries>

  5. Save the file.
  6. Restart all services for changes to apply:

    alienvault-reconfig -c -v -d

Important: If connecting to multiple databases, you must repeat this task for every external database you want to receive data from. In other words, you must create a different <database-plugin>.cfg.local file for each database you want to connect to.

If you do not see any events in Analysis > Security Events (SIEM) after you have modified the plugin configuration file and enabled the plugin, you can troubleshoot the database connection using tcpdump or ngrep. The following example examines the traffic to a MSSQL database.

ngrep -d eth0 host 10.10.10.10

where 10.10.10.10 is the IP address of the database server. If the database connection is established, you will see output similar to the following. You can confirm the user name, password, and database name (high-lighted in bold) from the output.

interface: eth0 (10.10.10.10/255.255.255.224)

filter: (ip or ip6) and ( host 10.10.10.10 )

......

#####

T 10.10.10.20:54983 -> 10.10.10.10:1433 [AP]

........10.10.10.10..................siem.................... PASSWORD

..............37876...............pymssql............10.10.10.10............

...... PASSWORD....................DB-Library........us_english.............

....L.........................ANSI_X3.4-1968..................512............

#

T 10.10.10.10:1433 -> 10.10.10.20:54983 [AP]

.....g.......ePO4_HOSTNAME17.master.B.E.....-.Changed database context to

'ePO4_HOSTNAME17'..HOSTNAME15........iso_1... .......Microsoft SQL

Server.._........512.512.........

If the database connection cannot be established, you will receive an error instead.