Downloaded 113 times
Uploaded byAlienVault
Improve Threat Detection with OSSEC and AlienVault USM
AlienVault provides mid-sized businesses with unified security products, intelligence, and community resources for modern threat defense. The document details AlienVault's capabilities, including OSSEC features like log analysis and vulnerability assessment, along with an overview of the USM architecture and integrated tools. It also offers insights into event correlation and management through a comprehensive GUI for effective security monitoring.
More Related Content
Similar to Improve Threat Detection with OSSEC and AlienVault USM
Improve Threat Detection with OSSEC and AlienVault USM
- 2. About AlienVault AlienVault hasunified the security products, intelligence and community essential for mid-sized businesses to defend against today’s modern threats
- 3. Agenda OSSEC capabilities AlienVault USMcapabilities Demo – See it in action • Remote OSSEC agent deployment, configuration and management • Behavioral monitoring of servers and workstations • Logging and reporting for PCI compliance • Data correlation with IP reputation data, vulnerability scans and more • Correlating OSSEC events to detect attacks
- 4. OSSEC & AlienVaultUSM Learning the Basics…
- 5. OSSEC capabilities Log analysisbased intrusion detection File integrity checking Registry keys integrity checking (Windows) Signature based malware/rootkits detection Real-time alerting and active response
- 6. OSSEC Architecture Agent components: Logcollectord:Read logs (syslog, WMI, flat files) Syscheckd: File integrity checking Rootcheckd: Malware and rootkits detection Agentd: Forwards data to the server Server components: Remoted: Receives data from agents Analysisd: Processes data (main process) Monitord: Monitor agents
- 7. ASSET DISCOVERY • ActiveNetwork Scanning • Passive Network Scanning • Asset Inventory • Host-based Software Inventory VULNERABILITY ASSESSMENT • Continuous Vulnerability Monitoring • Authenticated / Unauthenticated Active Scanning BEHAVIORAL MONITORING • Log Collection • Netflow Analysis • Service Availability Monitoring SECURITY INTELLIGENCE/SIEM • SIEM Event Correlation • Incident Response THREAT DETECTION • Network IDS • Host IDS • File Integrity Monitoring USM Platform Integrated, Essential Security Controls
- 8. AlienVault USM Architecture Embeddedtools: Asset discovery: Nmap, Prads Behavioral monitoring: Netflow, Ntop, Nagios Threat detection: Snort, Suricata, OSSEC Vulnerability assessment: OpenVas External collectors: Syslog WMI SDEE
- 9. AlienVault Event Correlation AlienVaultUSM correlates events from multiple sources, crossing OSSEC alerts with information collected from embedded detectors and external sources.
- 10. OSSEC Management Interface •Status monitor • Events viewer • Agents control manager • Configuration manager • Rules viewer/editor • Logs viewer • Server control manager • Deployment manager • Rules viewer/editor AlienVault USM provides a comprehensive GUI for OSSEC alerts management:
- 11. Let’s See ItIn Action
- 12. 888.613.6023 ALIENVAULT.COM CONTACT US HELLO@ALIENVAULT.COM Test DriveAlienVault USM Download a Free 30-Day Trial http://www.alienvault.com/free-trial Try our Interactive Demo Site http://www.alienvault.com/live-demo-site Now for some Q&A.. Questions? Hello@AlienVault.com Twitter : @alienvault