OSSIM
5545041
222607785
2008-06-30T06:29:54Z
200.71.32.92
/* Components */
{{For|the [[GIS]] project|Open Source Geospatial Foundation}}
{{Infobox_Software |
name = OSSIM |
logo = <!-- Commented out because image was deleted: [[Image:OSSIM_logo.png|100px]] -->|
screenshot = |
caption = |
developer = OSSIM development team |
latest_release_version = 0.9.9 |
latest_release_date = [[Feb 20]], [[2008]] |
operating_system = [[Unix]] |
genre = [[Computer security|Security]] / [[Intrusion-detection system|IDS]] |
license = [[BSD License|BSD]] |
website = [http://www.ossim.net/ www.ossim.net] |
}}
{{Portal|Free software|Free Software Portal Logo.svg}}
{{Portal|Computer security}}
'''OSSIM''', or the '''Open Source Security Information Management''', is a [[BSD license]]d collection of tools designed to aid [[network administrators]] in [[computer security]], [[intrusion detection]] and [[intrusion prevention|prevention]].
The project's goal is to provide a comprehensive collection of tools to grant an administrator a view of all the security-related aspects of their system. OSSIM also provides a strong correlation engine, with detailed low-, mid- and high-level [[visualization interface]]s as well as reporting and [[incident managing tool]]s. The ability to act as an [[intrusion-prevention system]] based on correlated information from virtually any source results in a useful security tool. All this information can be filtered by network or sensor in order to provide just the information needed by specific users, allowing for a [[fine grained]] multi-user security environment.
== Components ==
[[Image:Ossim-metrics.png|thumb|OSSIM Web Framework]]
Ossim features the following software components:
* [[Arpwatch]], used for [[MAC address]] anomaly detection.
* P0f, used for passive [[OS]] detection and OS change analysis.
* Pads, used for service anomaly detection.
* [[Nessus (software)|Nessus]], used for vulnerability assessment and for cross correlation ([[Intrusion detection system]] (IDS) vs [[Vulnerability Scanner]]).
* [[Snort (software)|Snort]], used as a [[Intrusion detection system]] (IDS), and also used for cross correlation with Nessus.
* Spade, the ''statistical packet anomaly detection engine''. Used to gain knowledge about attacks without signature.
* Tcptrack, used for session data information which can grant useful information for attack correlation.
* Ntop, which builds an impressive network information database for aberrant behaviour anomaly detection.
* [[Nagios]], used to monitor host and service availability information based on a host asset database.
* Osiris, a [[Host-based intrusion detection system]] (HIDS).
* Snare, a log collector for windows systems.
* OSSEC, a host based IDS.
* OSSIM also includes self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins.
== External links ==
*[http://www.ossim.net Official website]
*[http://www.ossim.net/forums Forums website]
*[http://www.ossim.com Commercial website]
*[http://sourceforge.net/projects/os-sim/ Project web at Sourceforge]
*[http://www.ossim.com/home.php?id=download Download Installer for OSSIM]
{{compu-soft-stub}}
[[Category:Network-related software]]
[[Category:Linux security software]]