The second OSSEC week just ended. Here is a reflection about
a feature that does not exist (yet?) in OSSEC. The goal of a SIEM
(“Security Incidents and Events Management“) is to
collect logs from multiple non-heterogeneous sources and process
them to add some extra value to the events. To achieve this,
powerful correlation engines can be used to create rules to match
different types of events coming from different sources and
to create a unique security incident:
if (condition1 && condition2 && condition3)
{
created_security_alert();
}
Once created, The security incident must be processed. The basic
action is to notify the right people with messages displayed on a
console, new events, emails, etc. But, depending on their
criticality, not all security incidents must result in messages.
Some correlation rules results may just create new …
[Lire plus]