you should try to pare down the list based on your networks. I have A HUGE
network at work (400 sites, tons of public-facing servers). Properly
defining the web servers, DNS servers, FTP servers, etc will help.
Check the top 5 every day and see if they are valid or false positives. If
they are false positives, whack 'em. The guy who initially set our SNORT
box up used the complete rule set and we were getting tons of alerts. I've
been working on it for an hour a day for a week or so and it's much more
tuned now.
Stew
On Thu, Jul 10, 2008 at 8:00 AM, Brent Clark <brentgclarklist@gmail.com>
wrote:
Hi List
I got the oinkmaster working and updating, but what interested me is
that the load average shot up just after i ran the update (specs of the
machine arnt great).
My question is, are we supposed to use ALL signatures offered, or what
method / practices is adopted or used.
Thank you in advance for you assistance in advance.
Regard
Brent Clark
-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-usersSnort-users>list
archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
--
Stewart
--
You only lose what you cling to.
-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
