Hi Gary
Yes, I appreciate if you can send a screenshot of the signatures....
Actually I'm starting studying security stuff on the beginning of this year,
but I think it's good if I can start studying the signature that way I can
better understand the treats.... Don't you think ???
If someone could let me know where I can find the signature to Snort I
really appreciate once I starting the VM to studying the behavior of the
internet connection just for learning purpose.
Thanks,
Marcio
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of Gary Halleen
Sent: sexta-feira, 12 de outubro de 2007 18:14
To: randy@procyonlabs.com
Cc: focus-ids@securityfocus.com
Subject: Re: IDS detection approaches
Randy,
Anyone with a CCO account can download the signatures. However, as I stated
in my earlier e-mail, they're not useful to you unless you have a Cisco IPS
sensor, whether a standalone appliance (4200-series), switch module
(IDSM-2), firewall module (AIP-10 or 20), router module, or router IOS IPS.
When I say the signatures are open, I mean that there is nothing to prevent
you from viewing all settings, modifying them, cloning them, deleting them,
or creating your own signatures. The signatures are not "locked" or
"hidden", in other words.
I would be more than happy to provide you with screenshots showing what the
signatures look like, and what options you have for modifying them. Unless
the entire list wants to see it, I'll unicast it to you if you want it. I
don't want to misuse the list by marketing our products, but if there are
things you genuinely want to see, I'll provide it.
Gary
On 10/12/07 9:00 AM, "randy@procyonlabs.com" <randy@procyonlabs.com> wrote:
So it is "open" to any paying customer of Cisco?
What makes Cisco's IDS rules "open" then? I ask because the abuse of
the term is overwhelming. It is my understanding that "open" means the
technology plays well with others, using standardized popular
methodology shared amongst the community.
Now, I do have a valid CCO account, but we have no IDS devices on the
contracts. Can I still download the rules, despite the warnings given
that I must have a specific contract/license to do so?
Thanks,
Randy
Anyone with a valid license is able to download the signatures to be
placed on your Cisco sensor. Once you have placed them on your
sensor, you are free to open/edit/manipulate or add to the signatures at
will.
Open signatures does not mean they are "open source" or free.
Without a Cisco sensor, they won't be much use to you.
If you have a CCO account, you can download the signatures at:
http://www.cisco.com/cgi-bin/tablebuild.pl/ips6-sigup
Gary
On 10/12/07 9:59 PM, "Randal T. Rioux" <randy@procyonlabs.com> wrote:
Gary Halleen wrote:
<snip>
Additionally, all Cisco IPS signatures are open. You are able to
view all or most fields of signatures, create your own, and modify
existing signatures. You do not need to wait for Cisco to release
new signatures
if
you have sufficient IDS/IPS skills to write a new signature. If
you can write a snort rule, you can write a Cisco IPS signature.
Open? Really? Where can I download them?
Thanks,
Randy
---------------------------------------------------------------------
---
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks
from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&camp
aign=int
ro
_sfw
to learn more.
---------------------------------------------------------------------
---
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in
tro_sfw
to learn more.
------------------------------------------------------------------------
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.5.488 / Virus Database: 269.14.12/1072 - Release Date: 15/10/2007
17:55
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.5.488 / Virus Database: 269.14.12/1072 - Release Date: 15/10/2007
17:55
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
