ossim - setup asa logs

שלבים

1. 1

   שלב 1

   1. go to /etc/ossim/agent/plugins/
      edit cisco-asa.cfg
      add the next line
      location=/var/log/cisco-asa.log
   2. go to /etc/rsyslog.d/cisco_asa.conf
      and add the next lines :
      if $fromhost-ip == '192.168.100.1' then /var/log/cisco-asa.log
      if $fromhost-ip == '192.168.100.1' then
   3. restart the service
      service rsyslog restart
   4. configure the log rotation on
      /etc/logrotate.conf
   5. on alienvault menu go to
      configure sensor
      select data sources
      select cisco-asa
      apply changes
   6. ssh the asa firewall and on conf t set
      no names
      apply and save.