[ISSForum] [[SPAM]] Tuning Server Sensors

All,

Lately I've been working on tuning server sensors deployed on Windows
servers.  With pam.report.filter.<issueid> in the advanced parameters
settings I can quiet some noisy applications by ignoring specific sigs
from specific source IP addresses.  But in some cases that still isn't
granular enough.  For instance, for an application that makes many
connections on, say, TCP/9999, may set off TCP_Probe_Other because it
surpasses the threshhold for that sig.  I could, if I wanted to, dial
back the threshholds in the advanced settings for that sig.  But I'm
concerned I might introduce false negatives because that setting would
apply to ALL ports.  What I'd really like is an extension to
pam.report.filter that allows the server sensor to ignore an issueid
from a specific source IP address when combined with a specific
destination port.   

I've looked through the docs but I haven't found any way to do anything
that granular.  Does anyone know if this is possible?

TIA
Jason Baeder



                
__________________________________ 
Yahoo! Music Unlimited 
Access over 1 million songs. Try it free. 
http://music.yahoo.com/unlimited/

_______________________________________________
ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 
6303 Barfield Road, Atlanta, Georgia, USA 30328.