I tried to use OSSIM in the past without much success. The installation was horrible and it lacked some of the options I wanted (like being able to easily modify the code and configure it for my company "special" requirements).
Since our main concern was with log correlation (from syslog and snort) we ended up writting our own perl/php code to handle that. Lately we have been looking again for an open source SIM solution and we found OSSEC (ossec.net) to be a very good solution. It has a very good syslog correlation and it also supports snort and fw logs. On the negative side, it does not have a web interface (but we are doing that by ourselves). thanks. Mark --- Koolk3 <[EMAIL PROTECTED]> schrieb: > Hello everyone, > > I have been following these lists for some time now > and have seen some > messages on OSSIM (www.ossim.net) [Open Source > Security Information > Management]. It seems like a great product but lacks > documentation and > reviews on the Internet. > > I am looking for some feedback on the usefulness and > practicaility > (interms or maintenance and configuration) of this > software. I am > mainly interested in OSSIM as a corelation tool / > log analysis for > now. But if it works well as an IDS I would like to > propose this as an > alternative to commercial IDS to the management. > > Has anyone tried the latest version of the product > (0.9.9)? Any > feedback on installation and usability would be > great. > > I would be very much interested in hearing your > success or horror > stories with this. > > I have searched the web for 3rd party reviews on > this. Haven't found > much. So if you know of any please let me know. > > Thanks. > > KoolK3 > > ------------------------------------------------------------------------ > Test Your IDS > > Is your IDS deployed correctly? > Find out quickly and easily by testing it > with real-world attacks from CORE IMPACT. > Go to > http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 > > to learn more. > ------------------------------------------------------------------------ > > __________________________________________________ Do You Yahoo!? Sie sind Spam leid? Yahoo! Mail verfügt über einen herausragenden Schutz gegen Massenmails. http://mail.yahoo.com ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
