AlienVault: Monitoring individual sensor Events Per Second [EPS]

In a distributed AlienVault environment, it is important to be able to monitor individual sensor’s output. In our case, the requirements was to:

  • Monitor each sensor’s generated events over a configurable interval
  • If the number of generated events of a sensor goes below a configured threshold, then notify the user via email

There are several sensor monitoring options built right into alienvault, including monitoring the /var/log/alienvault/agent/agent.log which contains “EPS” information. However, in this case we use the database to calculate, for each sensor, the number of generated events. We are not interested in exactly which alienvault plugin generated the event, just the global number of events a particular sensor has generated.

The custom script can be used without installing any pre-requisites on a central SIEM server which sensors feed information into. The script ( depends on the following two configuration file:

  • /etc/ossim/ossim_setup.conf: this file already exists in a default AlienVault installation and should not be changed. uses this only to lookup the database settings
  • /etc/ossim/eps_monitor.conf: this file must be created and is used to store specific settings for the EPS_Script. A sample eps_monitor.conf script can be found below:


The config file is simple. It contains SMTP server details which are used to send emails, and default settings like the interval over which to query the number of events, and the default threshold (number of events). If the number of events generated is below the threshold, the user gets alerted. In the [thresholds] section a user can also define thresholds for individual sensors, enabling further flexibility.

The actual code is shown below:

import MySQLdb
import ConfigParser
import smtplib
import os
#get database settings
# hack to comply with Alienvault config file format:
from io import StringIO
filename = '/etc/ossim/ossim_setup.conf'
vfile = StringIO(u'[misc]\n%s' % open(filename).read())
db_config = ConfigParser.ConfigParser()
db_ip=db_config.get("database", "db_ip")
db_user=db_config.get("database", "user")
db_password=db_config.get("database", "pass")
#read settings from config file
## sample config file
# [settings]
# default_interval_mins=5
# default_threshold=1000
# smtp_server=
# [thresholds]
# sensorname=1000
eps_config = ConfigParser.ConfigParser()"/etc/ossim/eps_monitor.conf")
default_interval_mins=eps_config.get("settings", "default_interval_mins")
default_threshold=eps_config.get("settings", "default_threshold")
db = MySQLdb.connect( db_ip, db_user, db_password, "alienvault" )
cursor = db.cursor()
# execute SQL query using execute() method.
cursor.execute("select hex(id),name from sensor")
results = cursor.fetchall()
for row in results:
print os.linesep
db = MySQLdb.connect( db_ip, db_user, db_password, "alienvault_siem" )
cursor = db.cursor()
sql ='select COUNT(*) from acid_event WHERE device_id in (select id from device where hex(sensor_id)="'+row[0]+'") AND timestamp > now() – INTERVAL '+default_interval_mins+' MINUTE;'
result = cursor.fetchone()
print "%s: %s" % (row[1],result[0])
if row[1].lower() in thresholds:
sensor_threshold = int(eps_config.get('thresholds', row[1]))
sensor_threshold = int(default_threshold)
if result[0] < sensor_threshold:
sender = eps_config.get('settings', 'sender')
recipient = eps_config.get('settings', 'recipient')
smtp_server = eps_config.get('settings', 'smtp_server')
message = """From: AlienVault EPS Monitor <%s>
To: <%s>
Subject: AlienVault EPS monitor alert
This alert has been triggered since the generated EPS of sensor %s is currently %s
""" % (sender, recipient, row[1], result[0])
smtpObj = smtplib.SMTP(smtp_server)
smtpObj.sendmail(sender, recipient, message)
print "Successfully sent email"
except SMTPException:
print "Error: unable to send email"
print "looking good…"
print os.linesep

view raw

hosted with ❤ by GitHub

The script starts off by parsing it’s configuration files. Next, the script retrieves a list of configured sensors from the sensor table in the alievault database. The ID of these sensors is stored in binary form, therefore we convert this into hex. The main work of the script is performed in the for loop starting at line 45. Each sensor can have multiple “devices” bound to it. From what we can tell, these devices correspond roughly to each OSSEC agent installed on the network (Environment > Detection > HIDS > Agents)


Note : In light of the above, the script may only be monitoring events generated by OSSEC agents. Further testing is required to confirm / deny this

For each sensor retrieved from the previous query, the script retrieves the list of associated “devices” or agents. In a distributed environment with multiple sensors, different agents/devices can point to different sensors so this step is important to “map” agents to the appropriate sensors else the EPS count will be skewed.

The script then counts all entries made by devices mapped to a specific sensor in the specified time interval and if below the specified threshold, sends and email to the appropriate recipients


All that’s left is to run the script periodically in a cron job. Normally the cron job interval should be the same as the one specified in the EPS monitoring script configuration file

Privacy Settings

One thought on “AlienVault: Monitoring individual sensor Events Per Second [EPS]

Comments are closed.