SIEM Lab Setup: AlienVault

AlienVault OSSIM is an Open Source Security Information and Event Management (SIEM), which provides you with the feature-rich open source SIEM complete with event collection, normalization, and correlation. OSSIM is a unified platform which is providing the essential security capabilities like: –

  • Asset discovery
  • Vulnerability assessment
  • Host Intrusion detection
  • Network intrusion detection
  • Behavioural monitoring
  • SIEM event correlation

It is already loaded with the power of the AlienVault Open Threat Exchange (OTX). The open threat intelligence community provides community-generated threat intelligence and allows you to collaborate with them and also automates the process of updating your security infrastructure with threat data from any source.

AlienVault is very useful for monitoring your system security event or vulnerability and can help you to audit assessment security like PCI-DSS.

So, without wasting more time or much theory let’s begin the installation process. AlienVault OSSIM ISO can be easily found on the AlienVault OSSIM product page.

Table of Content

  • Prerequisites
  • Installation
  • Setup log monitoring interface
  • Web UI Access

Prerequisites

For the installation of AlienVault OSSIM, there are some minimum requirements as listed below.

  • VMware or Virtual Box
  • 2 NIC (Network interface card) E1000 compatible network cards

(You can have multiple NICs for Log Management or network monitoring)

  • 4 CPU cores
  • 4-8GB RAM
  • 60GB HDD

Installation

Once you’ve downloaded the AlienVault OSSIM ISO file, begin installation It on your virtual machine.

To install AlienVault OSSIM

  • In your virtual machine, create a new VM instance using the AlienVault OSSIM ISO as the installation source.
  • Complete the requirements of AlienVault as shown below.

Once you launch the new AlienVault instance, select Install AlienVault OSSIM 5.7.4 (64 Bit) and Hit Enter As shown below

The installation process takes you through a tour of setup options choose as per your requirements.

  • Select language that you want to use

Select your location

Configure the network by Assigning

As we have 1 or more Network interface cards choose one for the primary network interface card for the management server. The IP address will be used to access AlienVault OSSIM Web UI. We are going to use eth0 for the management and the rest of the network is connected to eth1.

Assign a Unique IP address to the server as shown below. If you don’t know what to use here, consult your network administrator.

Assign the Netmask of the assigned unique IP address

Provide the Gateway: That indicates the gateway router, as known as the default router. All traffic goes outside your LAN is sent through this router.

Then the installation process takes you to set up a root password this will be used for the root login account in the AlienVault OSSIM login console.

Then on the next prompt set up your time zone as the final step.

And then it will install the base system. It takes quite long depends on your system speed as usually, it takes 10-15 to finish the installation till then go get served you with a coffee ☕.

You can now login to the AlienVault OSSIM console with the root user and enter the password that you designated in the setup process.

Login with credentials of the root account.

Setup log monitoring interface

After successfully login, you must configure the log management interface.

To set up a network interface for log management and scanning follow the steps as described below.

Click on System Preferences > Configure Network > Setup Network Interface > eth1 > IP address > netmask.

Go to System Preferences

Select Configure Network

Select Network Interface

Select eth1 for log management and scanning.

Assign a unique IP address to set up a network management interface.

Assign the netmask of the designated IP address.

And then come back to the AlienVault setup by selecting back and back and then select Apply all Changes as shown below.

Verify the changes that you have done if correct then select yes.

Now you have successfully set up the Network interface for the log management !!!

Hmm 😃 !! you have successfully installed and set upped AlienVault in VMware.

Web UI Access

By completing the installation process, you can access the Web UI and setup your admin account.

To access Web UI, open up your favourite browser and visit 

Hold tight! this is not enough…..

Have patience 😉

Author – Vijay is a Certified Ethical Hacker, Technical writer and Penetration Tester at Hacking Articles. Technology and Gadget freak. Contact Here

Leave a Reply

Your email address will not be published. Required fields are marked *