I am afraid there is no way to get rid of ALL the false positives !
When I was dealing with IDS some two years ago, I configured two identical
Snorts, one stayed with the default config, and the second one was tunned (by
editing snort config file and changing the alerts when necessary) day after
day, attack after attack, alert after alert ... to finally get to a well-tuned
IDS.
Some IDS are better than others as they will give you less false positives, but
with an open source as Snort, you will have some work to do tunning it before
having an reliable IDS ...
HTH :)
-----Message d'origine-----
De : Jeremy Gonzales [mailto:jerdgonzales@yahoo.com]
Envoyé : lundi 27 septembre 2004 22:09
À : focus-ids@securityfocus.com
Objet : Snort
Hi,
Does anyone have experience with snort reports? How do you deal with the loads
of information? Is there a way to generate reports that eliminate the false
positives? Any help will be appreciated.
Thanks,
Jeremy.
__________________________________
Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to
learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to
learn more.
--------------------------------------------------------------------------
