Wanting to find a good SIEM that is relatively inexpensive, I started looking at the various options that are out there, and ended up falling in love with OSSIM.

…then, I discovered that AT&T bought the company up.

…and basically eliminated their EC2 offerings.

Not to be completely disappointed, I downloaded the Alienvault OSSIM ISO and started looking at it. It’s a relatively simple debian stretch iso that has had some customizations to it. The usual location of the preeseed file came out with a few zero size files – a dead end – so, I wanted to poke around some more.

…