OSSIM 5545041 222607785 2008-06-30T06:29:54Z 200.71.32.92 /* Components */ {{For|the [[GIS]] project|Open Source Geospatial Foundation}} {{Infobox_Software | name = OSSIM | logo = <!-- Commented out because image was deleted: [[Image:OSSIM_logo.png|100px]] -->| screenshot = | caption = | developer = OSSIM development team | latest_release_version = 0.9.9 | latest_release_date = [[Feb 20]], [[2008]] | operating_system = [[Unix]] | genre = [[Computer security|Security]] / [[Intrusion-detection system|IDS]] | license = [[BSD License|BSD]] | website = [http://www.ossim.net/ www.ossim.net] | }} {{Portal|Free software|Free Software Portal Logo.svg}} {{Portal|Computer security}} '''OSSIM''', or the '''Open Source Security Information Management''', is a [[BSD license]]d collection of tools designed to aid [[network administrators]] in [[computer security]], [[intrusion detection]] and [[intrusion prevention|prevention]]. The project's goal is to provide a comprehensive collection of tools to grant an administrator a view of all the security-related aspects of their system. OSSIM also provides a strong correlation engine, with detailed low-, mid- and high-level [[visualization interface]]s as well as reporting and [[incident managing tool]]s. The ability to act as an [[intrusion-prevention system]] based on correlated information from virtually any source results in a useful security tool. All this information can be filtered by network or sensor in order to provide just the information needed by specific users, allowing for a [[fine grained]] multi-user security environment. == Components == [[Image:Ossim-metrics.png|thumb|OSSIM Web Framework]] Ossim features the following software components: * [[Arpwatch]], used for [[MAC address]] anomaly detection. * P0f, used for passive [[OS]] detection and OS change analysis. * Pads, used for service anomaly detection. * [[Nessus (software)|Nessus]], used for vulnerability assessment and for cross correlation ([[Intrusion detection system]] (IDS) vs [[Vulnerability Scanner]]). * [[Snort (software)|Snort]], used as a [[Intrusion detection system]] (IDS), and also used for cross correlation with Nessus. * Spade, the ''statistical packet anomaly detection engine''. Used to gain knowledge about attacks without signature. * Tcptrack, used for session data information which can grant useful information for attack correlation. * Ntop, which builds an impressive network information database for aberrant behaviour anomaly detection. * [[Nagios]], used to monitor host and service availability information based on a host asset database. * Osiris, a [[Host-based intrusion detection system]] (HIDS). * Snare, a log collector for windows systems. * OSSEC, a host based IDS. * OSSIM also includes self developed tools, the most important being a generic correlation engine with logical directive support and logs integration with plugins. == External links == *[http://www.ossim.net Official website] *[http://www.ossim.net/forums Forums website] *[http://www.ossim.com Commercial website] *[http://sourceforge.net/projects/os-sim/ Project web at Sourceforge] *[http://www.ossim.com/home.php?id=download Download Installer for OSSIM] {{compu-soft-stub}} [[Category:Network-related software]] [[Category:Linux security software]]