Graphical Web Interface for OSSEC WUI AnaLogi v1.1

Keep on Guard!


‘Analytical Log Interface’ was built to sit on top of OSSEC (built on OSSEC 2.6) and requires 0 modifications to OSSEC or the database schema that ships with OSSEC. AnaLogi requires a Webserver sporting PHP and MySQL.

Written for inhouse analysis work, released under GPL to give something back – it’s intended to help you spot trends in graphs from hosts/levels/ruleID breakdowns and then let the user drill down to the specific alerts.

AnaLogi v1.1

OSSEC is used for internal servers, therefore server names are treated as trusted and are not filtered for security within this project. For the same reason user input on the details page is not filtered… if you want to inject SQL, go ahead, you are the Sys Admin after all.

Log data IS treated as UNTRUSTED, and is validated before dumping to screen.

This was written and tested on a Virtual Machine, quad core, 4GB ram using a database with currently 1.2million alerts and 10 servers and performs fine.

If the interface gets slow over time you may want to consider your data retention period in the database and clean events out from time to time.

Download AnaLogi v1.1 here:

AnaLogi_v1.1.zip

Or read more here.

Learn about Countermeasures



Posted in: Countermeasures, Networking Hacking, Security Software

, , , ,

Latest Posts:


AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds
dcrawl - Web Crawler For Unique Domains dcrawl – Web Crawler For Unique Domains
dcrawl is a simple, but smart, multithreaded web crawler for randomly gathering huge lists of unique domain names. It will branch out indefinitely.
Time Warner Hacked - AWS Config Exposes 4M Subscribers Time Warner Hacked – AWS Config Exposes 4M Subscribers
What's the latest on the web, Time Warner Hacked is what it's about now as a bad AWS S3 config (once again) exposes the details of approximately 4M subs.


Comments are closed.