Re: [Snort-users] SnortAV?

--On December 28, 2006 7:30:07 PM -0500 jrhendri@maine.rr.com wrote:

> I would agree that testing a host after the fact is inherently prone to
> error.
>
> Does anyone know of any effort to integrate IDS with scanner output to
> achieve a (potentially more accurate) result? Something like doing daily
> nessus scans and tailoring snort output to alert for systems that were
> (potentially) vulnerable as of the last scan could be beneficial.
Yes.  Sourcefire RNA.

> Or you could just tune your IDS based on human intelligence and *patch*
> your systems based on nessus output :-)
I wouldn't patch my systems based on nessus output or the output from any 
other VA system.  They're far too prone to false positives.

Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

p7s6jMvl2doWe.p7s
Description: S/MIME cryptographic signature

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users