"IDS Tuning" could be defined as Customizing an IDS for ones network.
AFAIK "IDS tuning" would largely imply "IDS Signature Set tuning" which
further means tweaking/modifying the signature set to reduce false
positives and make the IDS more reliable and also faster in some
situations.
Every network is different in some way or other and hence signatures
that are required for a particular network may not be required for
another network. For example, if your network does not have APACHE based
Web servers then you can disable Apache category in Snort. This kind of
tuning may also give you better speed with the IDS.
Similarly, an admin would like to disable signatures which are likely to
produce too much of false positives in "his" network. I am not sure if
there is a document on this or not but to tune an IDS you need to have a
good understanding of all App level protocols (SMTP/FTP/Telnet/HTTP etc)
and also have a good understanding of the signature set.
HTH.
Regards,
Arun
-----Original Message-----
From: Naveen Sharma [mailto:naveenkat@gmail.com]
Sent: Friday, March 10, 2006 2:19 AM
To: focus-ids@securityfocus.com
Subject: IDS Tuning
Hi All,
What exactly is IDS tuning ? Please provide steps to tune Snort.
Thanks in advance.
Cordial regards
Naveen
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
