version 2.3.1

web frontend

analysis -> siem -> custom -> configure event tabs

adding some random columns generates common XML error:
You have whitespaces in your response

adding DATE from replacements tags is always generates the error for me.

version 2.3.1

web frontend
configuration -> collection-> plugin groups

press "edit" on plugin group,
than delete all plugins.
after removing the last one you see:
"Invalid ID" message

OSSIM version: 2.4
Schema Version: 2.3

In Monitors | Network --> New profile.

OSSIM thinks that there is a try attack in the input form.

Screenshots:

http://bayimg.com/hAnoCAAch (before add the new profile)

http://bayimg.com/HanOeAACh (after add the new profile)

If you use a host group with written accent you won't see any host group in "Assets->Assets->Host groups", after delete it from db you'll see again, for example at db server:

mysql> use ossim
mysql> select * from host_group;
+-------------------------+-------------+-------------+-------------+-------+
| name | threshold_c | threshold_a | rrd_profile | descr |
+-------------------------+-------------+-------------+-------------+-------+
[.....]
| Servidores_DNS_públicos | 30 | 30 | Server | |
+-------------------------+-------------+-------------+-------------+-------+

mysql>delete from host_group where name='Servidores_DNS_públicos';
Query OK, 1 row affected (0.00 sec)

I've run tests on two different boxes, with OpenVAS 2 (didn't change any configurations after the install), Nessus 4.02 and Nessus 4.2.

With all the tests, the Ping The Remote Host functionality doesn't work at all. The option is checked, but it doesn't determine if the host is alive or not. If the host is down, a basic scan takes 40 minutes, if the host is up it takes 2 minutes. It makes it very difficult to do any sort of meaningful scans on Class C networks etc.

2.2.1 - missing scan job profiles for newly created users

The priority setting suddenly does not work this week. No matter what value I signed via configuration->plugins, it is 0 when certain events populated.

I am trying to create a new policy. I select an action in "All Actions" list, and it doen't move to "Selected", no matter left double-click, right double-click, plug and move. nothing appears in "Selected".

Since the file /var/log/snort/alert is defined both in /etc/logrotate.d/snort and /etc/logrotate.d/ossim-agent, Logrotate is unable to rotate and compress the OSSIM agent's logs.

While installing sun-java with the graphical installer the text become unreadable.