 | This article's use of external links may not follow Wikipedia's policies or guidelines. (June 2024) |
| LevelBlue OSSIM (Retired) | |
|---|---|
| Original authors | Dominique Karg, Julio Casal, Ignacio Cabrera and Alberto Román |
| Developer | LevelBlue |
| Stable release | 5.8.11
/ May 10, 2022 |
| Operating system | Linux |
| Type | Security / SIEM |
| License | GNU General Public License |
| Website | levelblue.com |
OSSIM (Open Source Security Information Management) was formerly an open source security information and event management system, integrating a selection of tools designed to aid network administrators in computer security, intrusion detection and prevention.
In December, 2024, LevelBlue announced OSSIM is being retired.
The project began in 2003 as a collaboration between Dominique Karg, Julio Casal and later Alberto Román. In 2008 it became the basis for their company AlienVault. Following the acquisition of the Eureka project label and completion of R&D, AlienVault began selling a commercial derivative of OSSIM ('AlienVault Unified Security Management'). AlienVault was acquired by AT&T Communications and renamed AT&T Cybersecurity in 2018. In 2024, cybersecurity investor WillJam Ventures officially launched LevelBlue, a joint venture with AT&T, to form a new, standalone managed cybersecurity services business.
OSSIM had four major-version releases since its creation. An information visualization of the contributions to the source code for OSSIM was published at 8 years of OSSIM. The project has approximately 7.4 million lines of code. The current version of OSSIM is 5.7.5 and was released on September 16, 2019. Information about this release and past versions can be found here
As a SIEM system, OSSIM was intended to give security analysts and administrators a more complete view of all the security-related aspects of their system, by combining log management which can be extended with plugins and asset management and discovery with information from dedicated information security controls and detection systems. This information was then correlated together to create contexts to the information not visible from one piece alone. Alarm and availability views along with reporting capabilities are provided to enhance the capabilities of the tool and its utility to the security and systems engineers.
OSSIM performed these functions using other well-known open-source software security components, unifying them under a single browser-based user interface. The interface provided graphical analysis tools for information collected from the underlying open source software component (many of which are command line only tools that otherwise log only to a plain text file) and allowed centralized management of configuration options.
The software was distributed freely under the GNU General Public License. Unlike the individual components which may be installed onto an existing system, OSSIM was distributed as an installable ISO image designed to be deployed to a physical or virtual host as the core operating system of the host. OSSIM was built using Debian as its underlying operating system. Due to this core platform being open additional components abilities could be added and extended by the security administrators using standard packages and scripting as needed.
