Posts

Showing posts from April, 2017

Beginner’s guide: OSSIM Part 2

-
Image
Hope all of you are keeping well. Thank you all for the overwhelming support you people are giving me. So today we’ll deal with everything from basic OSSIM configuration to integrating different types of assets. Before we jump in to all of that I hope all of you are ready with installation. If not please visit my previous post, which is actually the first part. Beginner’s guide: OSSIM (Open Source Security Information Management) part 1 Make sure you have an active internet connection for your OSSIM. As you all know the Alienvault platform has five modules in it, which are the Asset discovery, vulnerability assessment, threat detection, behavioural monitoring and security intelligence. In simple words we add assets first, and then we’ll configure all those assets under each and every module of Alienvault respectively. If you're ready with everything mentioned in part 1, we can now move forward with the configurations. Here we’re just considering only OSSIM not USM.
11 comments
Read more

Can you ping a port?

-
Image
This is one of the top questions I hear at the time of a SIEM implementation. Most people (non-technical) think that just like doing a ‘ping’ to an IP address, we can do ping ports. Honestly, that is not possible. Then how can we actually check accessibility to a port, well there is a way. But before we jump in to it, we need to know a few basics about what a port is, and why we are not able to ping it.
Post a Comment
Read more

TCP/IP Suite

-
Image
  I hope all of you have already read my blog on OSI layers.   http://pentesterblogs.blogspot.in/2016/07/networking-terminologies.html Today we are going to discuss the TCP/IP suite. When compared with the OSI layer, we can see that few layers have been merged together in TCP/IP suite. Just like the OSI layers, TCP/IP suite is also made up of hierarchical protocols which are interactive and are not necessarily interdependent. OSI layer specifically defines functions of each layer in the model, whereas in TCP/IP suite, these independent protocols can be mixed and matched depending upon the need of the system. Just like the OSI model, upper level layers are supported by one or more lower level protocols in TCP/IP suite also.
1 comment
Read more