| Developer(s) | Alienvault |
|---|---|
| Stable release | 0.9.9 / February 20, 2008 |
| Operating system | Unix |
| Type | Security / IDS |
| License | Gpl |
| Website | www.ossim.net |
OSSIM, or the Open Source Security Information Management, is a collection of tools designed to aid network administrators in computer security, intrusion detection and prevention.
The project's goal is to provide a comprehensive collection of tools to grant an administrator a view of all the security-related aspects of their system. OSSIM also provides a strong correlation engine, with detailed low-, mid- and high-level visualization interfaces as well as reporting and incident managing tools. The ability to act as an intrusion-prevention system based on correlated information from virtually any source results in a useful security tool. All this information can be filtered by network or sensor in order to provide just the information needed by specific users, allowing for a fine grained multi-user security environment.
Components
Ossim features the following software components:
- Arpwatch, used for MAC address anomaly detection.
- P0f, used for passive OS detection and OS change analysis.
- Pads, used for service anomaly detection.
- Nessus, used for vulnerability assessment and for cross correlation (Intrusion detection system (IDS) vs Vulnerability Scanner).
- Snort, used as a Intrusion detection system (IDS), and also used for cross correlation with Nessus.
- Spade, the statistical packet anomaly detection engine. Used to gain knowledge about attacks without signature.
- Tcptrack, used for session data information which can grant useful information for attack correlation.
- Ntop, which builds an impressive network information database for aberrant behaviour anomaly detection.
- Nagios, used to monitor host and service availability information based on a host asset database.
- Osiris, a Host-based intrusion detection system (HIDS).
- Snare, a log collector for windows systems.
- OSSEC, a host based IDS.
- OSSIM also includes self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins.
External links
- Official website
- Forums website
- Commercial website
- Project web at Sourceforge
- Download Installer for OSSIM
 |
This computer software article is a stub. You can help Wikipedia by expanding it. |
This entry is from Wikipedia, the leading user-contributed encyclopedia. It may not have been reviewed by professional editors (see full disclaimer)
