Summary
OSSIM aims to unify network monitoring, security, correlation and qualification in one single tool. Using Snort, Acid, Mrtg, NTOP, OpenNMS, nmap, nessus and rrdtool, OSSIM team want the user to have full control over every network or security aspect.
Here you can read a full description of OSSIM [ pdf 
] or you can visit OSSIM homepage at www.ossim.net
Components
OSSIM is divided in 5 subsystems as represented in the following graph:
- Spade: network anomaly detection
- Snort: pattern matching intrusion detection system
- Acid: log viewer (Event Database)
- Ntop: network use monitor
- OpenNMS: Service availability monitoring
- Mrtg: graphing
- Mysql and PostgreSQL: data storage
- RRDtool: Round robin data storage
- Nessus: vulnerability assesment
- Nmap: Network discovery
- More to come...
About OSSIM
OSSIM's goal is to obtain a working SIM (Security Infrastructure Monitor) able to integrate, qualify and correlate both high level and low level security and network events which is capable to compete with commercial products recently appearing on the security market.
Integrate multiple opensource security/network monitoring products to obtain three network/host visibility levels:
- Low level log/alert/anomaly information
- Mid level network risk level information
- High level decision support information
Development languages
Supported platforms
- Linux
- Limited functionality on: *BSD, Solaris, MacosX
Conclusion
Using the above described systems and programming languages, OSSIM's goal is to get the most information out of every tool with the following objectives in mind:
- Event correlation
- Event qualification
- Network anomaly detection
- Qualified intrusion detection
- Network availability information
