Sorry for being two months late.
I run AlienVault OSSIM in a Proxmox VM. It uses OpenVAS 9 for vulnerability scanning, and it is much easier to set up for that purpose than installing OpenVAS on Debian or Ubuntu.
I also use its Suricata function… the sniffing interface is connected to a network TAP in order to see my LAN traffic. However, since I’m now running Suricata in pfSense, this may now be redundant.