Re: ssh and ids

[Christian Kreibich <christian () whoop org>]

Hey Marty,

On Tue, 2004-06-22 at 14:11, Martin Roesch wrote:
> RNA doesn't just do "port profiling".  The detection of a new active 
> port/service/protocol/server/etc may indicate activity that should be 
> analyzed by our policy compliance analysis stage on our management 
> console (now called the Sourcefire Defense Center).

how do you let people express policies? Couldn't really find any info on
that on your site (if it's in the downloadable papers -- sorry couldn't
be bothered to fill in the form).

> The result of this 
> analysis can then be leveraged to provide whatever kind of response the 
> user in interested in.

again, how do you let the user express this?

Thanks,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org



---------------------------------------------------------------------------

---------------------------------------------------------------------------