Have a look at the following knowledgebase article:
https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_sid=2myMzxth&p_lva=2190&p_faqid=2190&p_created=1068160356&p_sp=cF9zcmNoPTEmcF9ncmlkc29ydD0mcF9yb3dfY250PTEmcF9zZWFyY2hfdGV4dD0yMTkwJnBfc2VhcmNoX3R5cGU9MyZwX3Byb2RfbHZsMT1_YW55fiZwX3Byb2RfbHZsMj1_YW55fiZwX2NhdF9sdmwxPX5hbnl_JnBfc29ydF9ieT1kZmx0JnBfcGFnZT0x&p_li=
Attached in this article is a file called pam.zip. This file contains PAM
(Protocol Analysis Module) tuning parameters.
/andreas
-----Ursprungligt meddelande-----
Från: issforum-bounces@atla-mm1.iss.net För Soda, Marc
Skickat: den 20 december 2004 19:24
Till: issforum@atla-mm1.iss.net
Ämne: [ISSForum] Signature tuning
Hello all,
Is anyone aware of documentation or resources for tuning specific IDS
signatures? I'm trying to eliminate a high number of false positives.
Thanks,
--
Marc Soda, CISSP
Information Security Engineer
NCO Group
215.441.2189
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
