Before I catch too many flames, let me clarify that I recommend a good
SIM product, of which MARS is one.
Some other good products to take a look at, in my opinion, would be:
NetForensics
Micromuse
eSecurity
Arcsight
Obviously, I am partial to MARS.
The important thing is that the SIM work in your environment, be able to
work with your chosen security products, and provide good enough
correlation to help you make sense of an overwhelming quantity of logs
from your security devices and software.
Gary
-----Original Message-----
From: Gary Halleen (ghalleen)
Sent: Tuesday, December 27, 2005 8:39 PM
To: Sam Heshbon
Cc: focus-ids@securityfocus.com
Subject: RE: Tuning false positives
Take a look at a good SIM product, like CS-MARS from Cisco Systems.
This correlates IPS/IDS events with firewall and other network device
logs, and also with vulnerability assessment tools (including NESSUS
built-in). This correlation is again correlated with network topology
information, and automatically tunes your events for you.
In addition, there is a wealth of reports and query capabilities, as
well as a lot of options for manually creating rules and doing further
tuning.
Even though it is from Cisco, it works with most IDS/IPS and firewall
products, not just Cisco.
Gary
-----Original Message-----
From: Sam Heshbon [mailto:sheshbon@yahoo.com]
Sent: Sunday, December 25, 2005 3:21 AM
To: focus-ids@lists.securityfocus.com
Subject: Tuning false positives
My company is testing a few intrusion detection & prevention products.
On the first few hours/days after deployment the machines alert on ten
of thousands of events, which is way too much for us to ever go through,
most of which are false alarms.
The vendor's solution is tuning the systems, which means shutting down
signatures, detection mechanisms, omitting defragmentation tests and so
on. These tunings do reduce dramatically the number of alerts, but it
seems most of the detection capabilities have been shut off too, so
things are nice and quite but we've no idea what's really going on in
our network apart from catching the trivial threats such as old worms,
which don't get false alarms.
Has anyone encountered this situation? Anyone got a solution?
Thanks
Sam
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
