Jump to content

OSSIM: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous edit
Content deleted Content added
VisualWikitext
No edit summary
Do648j (talk | contribs)
30 edits
mNo edit summary
 
(43 intermediate revisions by 30 users not shown)
Line 1: Line 1:
{{short description|Security information and event management system}}
{{For|the [[GIS]] project|Open Source Geospatial Foundation}}
{{For|the [[GIS]] project|Open Source Geospatial Foundation}}
{{Multiple issues|
⚫
{{Infobox software|
{{Cleanup bare URLs|date=September 2022}}
⚫
name = OSSIM |
⚫
{{External links|date=June 2024}}
logo = [[Image:AlienVault OSSIM Software Logo.png|100px]] |
screenshot = [[Image:Alienvault capture.png|180px|OSSIM Web Framework]] |
⚫
caption = OSSIM Web Framework |
⚫
developer = [[AlienVault]] |
⚫
latest_release_version = 5.3.0 |
⚫
latest_release_date = August 2, 2016|
⚫
operating_system = [[Linux]] |
⚫
genre = [[Computer security|Security]] / [[SIEM]] |
⚫
license = [[GNU General Public License]] |
⚫
website = [https://www.alienvault.com/products/ossim alienvault.com] |
}}
}}
⚫
{{Infobox software
⚫
'''OSSIM (Open Source Security Information Management)''' is an open source [[security information and event management]] system, integrating a selection of tools designed to aid [[network administrator]]s in [[computer security]], [[intrusion detection]] and [[intrusion prevention|prevention]].
⚫
| name = LevelBlue OSSIM (Retired)
| logo size = 100px
Framework]]
⚫
| caption = OSSIM Web Framework
| author = Dominique Karg, Julio Casal, Ignacio
Cabrera and Alberto Román
⚫
| developer = [[LevelBlue]]
⚫
| latest_release_version = 5.8.11
⚫
| latest_release_date = May 10, 2022
⚫
| operating_system = [[Linux]]
⚫
| genre = [[Computer security|Security]] / [[SIEM]]
⚫
| license = [[GNU General Public License]]
⚫
| website = [https://levelblue.com/products/ossim levelblue.com]
}}https://en.wikipedia.org/wiki/Software_release_life_cycle
⚫
'''OSSIM (Open Source Security Information Management)''' was formerly an open source [[security information and event management]] system, integrating a selection of tools designed to aid [[network administrator]]s in [[computer security]], [[intrusion detection]] and [[intrusion prevention|prevention]].


In December, 2024, LevelBlue announced OSSIM is being retired. <ref>{{Cite web|url=https://levelblue.com/products/ossim/|title= LevelBlue OSSIM Announcement| date= Dec 2024 }}</ref>
⚫
The project began in 2003 as a collaboration between Dominique Karg<ref>http://sourceforge.net/users/dkarg</ref>, Julio Casal <ref>http://sourceforge.net/users/jcasal</ref> and later Alberto Román <ref>http://sourceforge.net/users/alberto_r</ref>. In 2008 it became the basis for their company [[AlienVault]].<ref>http://www.alienvault.com/c-suite-blog/of-dragons-elephants-aliens-a-decade-of-ossim</ref> Following the acquisition of the [[Eureka (organisation)|Eureka]] project label and completion of [[R&D]], AlienVault began selling a commercial derivative of OSSIM ('AlienVault Unified Security Management').


⚫
The project began in 2003 as a collaboration between Dominique Karg,<ref>{{Cite web|url=http://sourceforge.net/users/dkarg|title = Dkarg / Profile}}</ref> Julio Casal <ref>{{Cite web|url=http://sourceforge.net/users/jcasal|title = Jcasal / Profile}}</ref> and later Alberto Román.<ref>{{Cite web|url=http://sourceforge.net/users/alberto_r|title = Alberto_r / Profile}}</ref> In 2008 it became the basis for their company [[AlienVault]].<ref>{{Cite web|url=https://www.alienvault.com/blogs/industry-insights/of-dragons-elephants-aliens-a-decade-of-ossim|title=AT&T Cybersecurity Blog|date=3 May 2024 }}</ref> Following the acquisition of the [[Eureka (organisation)|Eureka]] project label and completion of [[R&D]], AlienVault began selling a commercial derivative of OSSIM ('AlienVault Unified Security Management'). AlienVault was acquired by AT&T Communications and renamed AT&T Cybersecurity in 2018.<ref>{{Cite web|url=https://about.att.com/story/2018/att_completes_acquisition_of_alienvault.html |title= AT&T Story |date=22 August 2018 }}</ref> In 2024, cybersecurity investor WillJam Ventures officially launched LevelBlue, a joint venture with AT&T, to form a new, standalone managed cybersecurity services business.<ref>{{Cite web|url=https://www.forbes.com/sites/stevemcdowell/2024/05/07/att-spins-out-cybersecurity-business-levelblue/|title= Forbes |date=8 May 2024 }}</ref>
⚫
OSSIM has had four major-version releases<ref>http://sourceforge.net/projects/os-sim/files/deprecated__check_readme/</ref> since its creation and is on a 5.x.x version numbering.<ref>http://forums.alienvault.com/discussion/1340/patch-release-v4-2-3</ref> An [[Information visualization]] of the contributions to the source code for OSSIM is published at [http://labs.alienvault.com/labs/index.php/2011/8-years-of-ossim/ 8 years of OSSIM]. The project has approximately 7.4 million lines of code.<ref>https://www.ohloh.net/p/alienvault-ossim/analyses/latest/languages_summary</ref>


⚫
OSSIM had four major-version releases<ref>{{cite web | url=http://sourceforge.net/projects/os-sim/files/deprecated__check_readme/ | title=AlienVault OSSIM - Browse Files at SourceForge.net }}</ref> since its creation. An [[information visualization]] of the contributions to the source code for OSSIM was published at 8 years of OSSIM. The project has approximately 7.4 million lines of code.<ref>https://www.ohloh.net/p/alienvault-ossim/analyses/latest/languages_summary</ref> The current version of OSSIM is 5.7.5 and was released on September 16, 2019. Information about this release and past versions can be found [https://success.alienvault.com/s/topic/0TO0Z000000oRSEWA2/appliance-product-announcements here]
{| class="wikitable"
| Version
| Release date
|-
| 1.04
| 23 February 2008
|-
| 2.1
| 10 July 2009
|-
| 3.0
| 16 September 2011
|-
| 4.0
| 17 July 2012
|-
| 5.0
| 20 April 2015
|-
| 5.3
| 2 August 2016
|}


As a [[SIEM]] system, OSSIM is intended to give security analysts and administrators a view of all the security-related aspects of their system, by combining [[log management and intelligence|log management]] and [[IT asset management|asset management and discovery]] with information from dedicated information security controls and detection systems. This information is then correlated together to create contexts to the information not visible from one piece alone.
As a [[SIEM]] system, OSSIM was intended to give security analysts and administrators a more complete view of all the security-related aspects of their system, by combining [[log management and intelligence|log management]] which can be extended with plugins and [[IT asset management|asset management and discovery]] with information from dedicated information security controls and detection systems. This information was then correlated together to create contexts to the information not visible from one piece alone. Alarm and availability views along with reporting capabilities are provided to enhance the capabilities of the tool and its utility to the security and systems engineers.


OSSIM performs these functions using other well-known<ref>http://www.sectools.org</ref> [[open-source software]] security components, unifying them under a single browser-based user interface. The interface provides graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allows centralized management of configuration options.
OSSIM performed these functions using other well-known<ref>{{cite web |url=http://www.sectools.org/ |title=Home |website=sectools.org}}</ref> [[open-source software]] security components, unifying them under a single browser-based user interface. The interface provided graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allowed centralized management of configuration options.


The software is distributed freely under the [[GNU General Public License]]. Unlike the individual components which may be installed onto an existing system, OSSIM is distributed as an installable [[ISO image]] designed to deployed to a physical or virtual host as the core operating system of the host. OSSIM is built using [[Debian GNU/Linux]] distribution as its underlying operating system.
The software was distributed freely under the [[GNU General Public License]]. Unlike the individual components which may be installed onto an existing system, OSSIM was distributed as an installable [[ISO image]] designed to be deployed to a physical or virtual host as the core operating system of the host. OSSIM was built using [[Debian]] as its underlying operating system. Due to this core platform being open additional components abilities could be added and extended by the security administrators using standard packages and scripting as needed.


== Components ==
== Components ==


OSSIM features the following software components:
OSSIM featured the following software components:


* [[PRADS]], used to identify hosts and services by passively monitoring network traffic. Added in release v4.0. <ref>AlienVault, [https://www.alienvault.com/forums/discussion/20/alienvault-ossim-v4-0-enhancement-summary "AlienVault OSSIM v4.0 Enhancement Summary"], ''AlienVault OSSIM v4.0 Enhancement Summary'', July 2012</ref>
* [[PRADS]], used to identify hosts and services by passively monitoring network traffic. Added in release v4.0.<ref>AlienVault, [https://www.alienvault.com/forums/discussion/20/alienvault-ossim-v4-0-enhancement-summary "AlienVault OSSIM v4.0 Enhancement Summary"], ''AlienVault OSSIM v4.0 Enhancement Summary'', July 2012</ref>
* [[OpenVAS]], used for vulnerability assessment and for cross correlation of ([[Intrusion detection system]] (IDS) alerts vs [[Vulnerability Scanner]]) information.
* [[Snort (software)|Snort]], used as an [[Intrusion detection system]] (IDS), and also used for cross correlation with OpenVAS.
* [[Snort (software)|Snort]], used as an [[Intrusion detection system]] (IDS), and also used for cross correlation with Nessus.
* [[Suricata (software)|Suricata]], used as an [[Intrusion detection system]] (IDS), as of version 4.2 this is the IDS used in the default configuration
* [[Suricata (software)|Suricata]], used as an [[Intrusion detection system]] (IDS), as of version 4.2 this is the IDS used in the default configuration
* Tcptrack, used for session data information which can grant useful information for attack correlation.
* Tcptrack, used for session data information which can grant useful information for attack correlation.
* [[Nagios]], used to monitor host and service availability information based on a host asset database.
* [[OSSEC]], a [[Host-based intrusion detection system]] (HIDS).
* [[Munin (network monitoring application)|Munin]], for traffic analysis and service watchdogging.
* [[Munin (network monitoring application)|Munin]], for traffic analysis and service watchdogging.
* NFSen/NFDump, used to collect and analyze [[NetFlow]] information.
* NFSen/NFDump, used to collect and analyze [[NetFlow]] information.
* FProbe, used to generate [[NetFlow]] data from captured traffic.
* FProbe, used to generate [[NetFlow]] data from captured traffic.
*[[Nagios]], used to monitor hosts and specified ports for asset availability a well as full local system Monitoring.<ref name="Josephsen2013">{{cite book|author=David Josephsen|title=Nagios: Building Enterprise-Grade Monitoring Infrastructures for Systems and Networks|url=https://books.google.com/books?id=sVAjoULb5GsC|date=27 March 2013|publisher=Prentice Hall|isbn=978-0-13-313568-8}}</ref>
⚫
* OSSIM also includes self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins.
*[[OpenVAS|OpenVas]], used for vulnerability assessment and associated to assets.

⚫
* OSSIM also included self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins.
Note: Suricata and Snort cannot be used at the same time. Snort is currently being phased out in favor of Suricata. <ref>AlienVault, [https://www.alienvault.com/forums/discussion/5257/alienvault-v5-0-3-patch-release "AlienVault v5.0.3 Patch Release"], ''AlienVault v5.0.3 Patch Release'', June 2 2015</ref>


== Deprecated Components ==
== Deprecated Components ==
Line 70: Line 53:
* [[P0f]], used for passive [[Operating system|OS]] detection and OS change analysis, replaced by PRADS.
* [[P0f]], used for passive [[Operating system|OS]] detection and OS change analysis, replaced by PRADS.
* PADS, used for service anomaly detection, replaced by PRADS.
* PADS, used for service anomaly detection, replaced by PRADS.
* [[Ntop]], for recording traffic patterns between hosts and host groups, and statistics on protocol usage, deprecated. <ref>AlienVault, [https://www.alienvault.com/forums/discussion/5257/alienvault-v5-0-3-patch-release "AlienVault v5.0.3 Patch Release"], ''AlienVault v5.0.3 Patch Release'', June 2 2015</ref>
* [[Ntop]], for recording traffic patterns between hosts and host groups, and statistics on protocol usage, deprecated.<ref>AlienVault, [https://www.alienvault.com/forums/discussion/5257/alienvault-v5-0-3-patch-release "AlienVault v5.0.3 Patch Release"], ''AlienVault v5.0.3 Patch Release'', June 2, 2015</ref>


==Open Threat Exchange==
==LevelBlue Labs Open Threat Exchange==
AlienVault maintains a [[crowdsourcing|crowd-sourced]] service for [[blacklist (computing)|IP reputation]] information, generated by (and available to anyone) with an active OSSIM installation. OTX uses [[tokenization (data security)|tokenized]] information from participating OSSIM installations to identify Internet addresses engaged in malicious activities and share that information to those same OSSIM installations.<ref>http://www.alienvault.com/alienvault-labs/open-threat-exchange</ref>
LevelBlue maintains a [[crowdsourcing|crowd-sourced]] service for [[blacklist (computing)|IP reputation]] information. It was launched in 2012<ref>{{Cite web|url=http://www.alienvault.com/alienvault-labs/open-threat-exchange|title = Open Threat Exchange (OTX) &#124; AT&T Cybersecurity| date=10 May 2023 }}</ref>


The LevelBlue Open Threat Exchange (OTX) is one of the largest open threat intelligence sharing communities in the world. With a global community of over 450,000 participants from 140 countries contributing threat indicators daily, OTX enables you to detect and respond to evolving threats faster and more effectively.
{{Portal|Free software|Computer security}}


It enables collaborative research and can integrate with a security stack to strengthen defenses with enriched threat intelligence, including millions of enriched indicators of compromise (IoCs) and details on threat groups, their infrastructure, and TTPs they are using.
⚫
==External links==
⚫
*[https://www.alienvault.com/products/ossim Official OSSIM Project Website]
*[https://www.alienvault.com/forums/ OSSIM Community Forum]
*[http://downloads.alienvault.com/c/download?version=current_ossim_source OSSIM Source Code Repository]


==References==
==References==
{{reflist}}
{{reflist}}


==External links==
{{DEFAULTSORT:Ossim}}
⚫
*[https://levelblue.com/products/ossim Official website]

{{Portalbar|Free and open-source software}}
{{authority control}}

[[Category:Internet Protocol based network software]]
[[Category:Internet Protocol based network software]]
[[Category:Linux security software]]
[[Category:Linux security software]]

Latest revision as of 15:44, 18 December 2024

For the GIS project, see Open Source Geospatial Foundation.
LevelBlue OSSIM (Retired)
Original author(s)Dominique Karg, Julio Casal, Ignacio Cabrera and Alberto Román
Developer(s)LevelBlue
Stable release
5.8.11 / May 10, 2022
Operating systemLinux
TypeSecurity / SIEM
LicenseGNU General Public License
Websitelevelblue.com

https://en.wikipedia.org/wiki/Software_release_life_cycle

OSSIM (Open Source Security Information Management) was formerly an open source security information and event management system, integrating a selection of tools designed to aid network administrators in computer security, intrusion detection and prevention.

In December, 2024, LevelBlue announced OSSIM is being retired. [1]

The project began in 2003 as a collaboration between Dominique Karg,[2] Julio Casal [3] and later Alberto Román.[4] In 2008 it became the basis for their company AlienVault.[5] Following the acquisition of the Eureka project label and completion of R&D, AlienVault began selling a commercial derivative of OSSIM ('AlienVault Unified Security Management'). AlienVault was acquired by AT&T Communications and renamed AT&T Cybersecurity in 2018.[6] In 2024, cybersecurity investor WillJam Ventures officially launched LevelBlue, a joint venture with AT&T, to form a new, standalone managed cybersecurity services business.[7]

OSSIM had four major-version releases[8] since its creation. An information visualization of the contributions to the source code for OSSIM was published at 8 years of OSSIM. The project has approximately 7.4 million lines of code.[9] The current version of OSSIM is 5.7.5 and was released on September 16, 2019. Information about this release and past versions can be found here

As a SIEM system, OSSIM was intended to give security analysts and administrators a more complete view of all the security-related aspects of their system, by combining log management which can be extended with plugins and asset management and discovery with information from dedicated information security controls and detection systems. This information was then correlated together to create contexts to the information not visible from one piece alone. Alarm and availability views along with reporting capabilities are provided to enhance the capabilities of the tool and its utility to the security and systems engineers.

OSSIM performed these functions using other well-known[10] open-source software security components, unifying them under a single browser-based user interface. The interface provided graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allowed centralized management of configuration options.

The software was distributed freely under the GNU General Public License. Unlike the individual components which may be installed onto an existing system, OSSIM was distributed as an installable ISO image designed to be deployed to a physical or virtual host as the core operating system of the host. OSSIM was built using Debian as its underlying operating system. Due to this core platform being open additional components abilities could be added and extended by the security administrators using standard packages and scripting as needed.

Components

[edit]

OSSIM featured the following software components:

  • PRADS, used to identify hosts and services by passively monitoring network traffic. Added in release v4.0.[11]
  • Snort, used as an Intrusion detection system (IDS), and also used for cross correlation with OpenVAS.
  • Suricata, used as an Intrusion detection system (IDS), as of version 4.2 this is the IDS used in the default configuration
  • Tcptrack, used for session data information which can grant useful information for attack correlation.
  • Munin, for traffic analysis and service watchdogging.
  • NFSen/NFDump, used to collect and analyze NetFlow information.
  • FProbe, used to generate NetFlow data from captured traffic.
  • Nagios, used to monitor hosts and specified ports for asset availability a well as full local system Monitoring.[12]
  • OpenVas, used for vulnerability assessment and associated to assets.
  • OSSIM also included self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins.

Deprecated Components

[edit]
  • Arpwatch, used for MAC address anomaly detection, replaced by PRADS.
  • P0f, used for passive OS detection and OS change analysis, replaced by PRADS.
  • PADS, used for service anomaly detection, replaced by PRADS.
  • Ntop, for recording traffic patterns between hosts and host groups, and statistics on protocol usage, deprecated.[13]

LevelBlue Labs Open Threat Exchange

[edit]

LevelBlue maintains a crowd-sourced service for IP reputation information. It was launched in 2012[14]

The LevelBlue Open Threat Exchange (OTX) is one of the largest open threat intelligence sharing communities in the world. With a global community of over 450,000 participants from 140 countries contributing threat indicators daily, OTX enables you to detect and respond to evolving threats faster and more effectively.

It enables collaborative research and can integrate with a security stack to strengthen defenses with enriched threat intelligence, including millions of enriched indicators of compromise (IoCs) and details on threat groups, their infrastructure, and TTPs they are using.

References

[edit]
  1. ^ "LevelBlue OSSIM Announcement". Dec 2024.
  2. ^ "Dkarg / Profile".
  3. ^ "Jcasal / Profile".
  4. ^ "Alberto_r / Profile".
  5. ^ "AT&T Cybersecurity Blog". 3 May 2024.
  6. ^ "AT&T Story". 22 August 2018.
  7. ^ "Forbes". 8 May 2024.
  8. ^ "AlienVault OSSIM - Browse Files at SourceForge.net".
  9. ^ https://www.ohloh.net/p/alienvault-ossim/analyses/latest/languages_summary
  10. ^ "Home". sectools.org.
  11. ^ AlienVault, "AlienVault OSSIM v4.0 Enhancement Summary", AlienVault OSSIM v4.0 Enhancement Summary, July 2012
  12. ^ David Josephsen (27 March 2013). Nagios: Building Enterprise-Grade Monitoring Infrastructures for Systems and Networks. Prentice Hall. ISBN 978-0-13-313568-8.
  13. ^ AlienVault, "AlienVault v5.0.3 Patch Release", AlienVault v5.0.3 Patch Release, June 2, 2015
  14. ^ "Open Threat Exchange (OTX) | AT&T Cybersecurity". 10 May 2023.
[edit]
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=OSSIM&oldid=1263777245"