Plugin Fundamentals

Applies to Product: USM Appliance™ LevelBlue OSSIM®

The USM Appliance Sensor uses plugins to extract and normalize data received from different data sources.

Note: You can examine which data sources are supported by default by examining the content of the /etc/ossim/agent/plugins directory, or by examining listed data sources in the LevelBlue Console or in the USM Appliance web UI.

During data normalization, a plugin evaluates each log file line and translates it to an event that identifies the event’s type and subtype within the USM Appliance Event Taxonomy.

Each USM Appliance plugin include two files

  • <plugin_name>.cfg — Resides on each USM Appliance Sensor under /etc/ossim/agent/plugins. This file specifies the plugin configuration parameters, and the rules a log line must match before USM Appliance collects and normalizes them.
  • <plugin_name>.sql — Resides on the USM Appliance Server under /usr/share/doc/ossim-mysql/contrib/plugins. This file describes every event, and the corresponding event fields, that the plugin may store in the SIEM database for events extracted from a data source.

Plugin Configuration File Structure

The following figure shows an example of the .cfg data source plugin file. The file shown in this example enables the USM Appliance Sensor to parse SSH events.

Details of configuration settings in plugin configuration file

The plugin configuration file consists of several sections.

Plugin .SQL Files

The .SQL file associated with a plugin defines all database entries inserted by events extracted from the plugin source data or log file.

  • Plugin ID
  • Event type ID
  • Database fields written for each event
  • Name assigned to the event
  • Priority and reliability values

The following illustration shows the ssh.sql file associated with the ssh.cfg file described in previous sections.

Illustration shows content of sample .sql file for typical plugin.

If you have , you need to import the corresponding plugin .sql file to the SIEM database using the following command:

cat <plugin_name>.sql | ossim-db