We constantly refine our IDS sigs. I don't see how anyone could not.
However it wasn't always that way. When we inherited the system, the
database was so full of false positives that it was completely unusable. We
pretty much had to start over.
Darren
-----Original Message-----
From: Anton A. Chuvakin [mailto:anton@chuvakin.org]
Sent: Thursday, June 09, 2005 12:01 PM
To: focus-ids@securityfocus.com
Subject: on NIDS/NIPS tuning
All,
I was thinking about some issues with IDS alerts (their volume, etc) and
realized I could use some help from the list. It might also be a fun
discussion item.
So, here it is: how many folks who buy/download a NIDS/NIPS actually tune
it? Long time ago when I was asking this question the previous time, I was
scared to learn that lots of people do not tune their NIDSs. Is it any
better now?
Best,
--
Anton A. Chuvakin, Ph.D., GCIA, GCIH, GCFA
http://www.info-secure.org
http://www.securitywarrior.com
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
