Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-IDS
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

RE: on NIDS/NIPS tuning

from [M. Shirk] Network Security [Permanent Link]
Subject: RE: on NIDS/NIPS tuning
Date: Fri, 10 Jun 2005 11:11:04 -0400
About a year ago, a client wanted ALL alerts with absolutely no filtering. This presented a problem for the analysts as there were 100,000+ events per day. We had to actually filter out events that were false positives and false alarms from the analysts' displays while still logging the events to a DB. There was a lot of wasted time on trying to archive and work with the DB when we could have just filtered the traffic.

That is the worst I can think of. In other environments, the sensors were tuned and regularly tested and were basically the analysts' best friends.

:-)

Shirkdog
http://www.shirkdog.us



From: "Anton A. Chuvakin" <anton@chuvakin.org>
To: focus-ids@securityfocus.com
Subject: on NIDS/NIPS tuning
Date: Thu, 9 Jun 2005 13:01:20 -0400 (EDT)

All,

I was thinking about some issues with IDS alerts (their volume, etc) and
realized I could use some help from the list. It might also be a  fun
discussion item.

So, here it is: how many folks who buy/download a NIDS/NIPS actually tune
it? Long time ago when I was asking this question the previous time, I was
scared to learn that lots of people do not tune their NIDSs. Is it any
better now?

Best,
--
Anton A. Chuvakin, Ph.D., GCIA, GCIH, GCFA
     http://www.info-secure.org
   http://www.securitywarrior.com


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------


_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  RE: IDS\IPS that can handle one Gig, Andrew Plato
Next by Date:  Re: on NIDS/NIPS tuning, Bob Huber
Previous by Thread:  Re: on NIDS/NIPS tuning, Adam Powers
Next by Thread:  RE: on NIDS/NIPS tuning, Phil Hollows
Indexes:  [Date] [Thread] [Top] [All Lists]