PFSense + OSSIM

[borja.ruiz]

I just coded a patch to make pfSenso 2.0 fully-working with OSSIM.

This patch simply adjust the syslog format of ossim PF (packet filter) logs in /etc/inc/filter.inc to make it "parseable" by OSSIM with no modification at all.

To use this patch:

1.- Copy the patch to /etc/inc/
2.- Apply the patch  (patch < ossim-logging.patch)
3.- Restar the service

Now, al filter (PF) logs from all pfSense boxes are native-adapted to OSSIM via this little trick ;-)

Regards
ossim-logging.patch.txt

[jimp]

Looks like that would reduce the amount of detail shown in the full logs. Does the firewall log view in the GUI still work properly when you have this active?

I'm not sure that's a change that many people would want to make, but it's not a large change, so people can change it on their own if they like.