You have to turn you snort.conf and your rules to weed these out. Setting
it up is the easy part, tuning is the hard part.
-----Original Message-----
From: snort-users-bounces@lists.sourceforge.net
[mailto:snort-users-bounces@lists.sourceforge.net] On Behalf Of Denis
Sacchet
Sent: Friday, August 25, 2006 8:32 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Rate of alert
Hello everybody,
I wonder if 60 unique alerts (for about 10000 alerts) is normal for a
snort configuration. Moreover, those alerts seems to not correspond
every time, and I adjust my rules to filter for example vulnerability on
IMAP server type, but my IMAP server is not of this type, IIS attack
onto apache web server, etc ...
Perhaps something is wrong in the configuration used.
Thanks for your point of view and your input about the number of alert
and the type;
Best regards
Denis Sacchet
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
