IDS mailing list archives
RE: IDS event filtering
From: "Phil Hollows" <phollows () open com>
Date: Mon, 3 Jan 2005 10:12:39 -0500
// vendor response You can use a SIM to correlate your IDS alarms with your VA scans in real time to strip out alerts that don't matter (patched systems) while retaining the ability to get warnings of rogue MSSQL systems (perhaps embedded in 3rd party products installed by your users). There are several products on the market, including my company's, OpenService. Depending on the approach, you don't have to do a detailed inventory first - SIMs can pick up the details from network traffic and the VA scan, as well as metadata inputs from you. Thank you, Sincerely, Phil Hollows VP Marketing OpenService, Inc. 110 Turnpike Road, Suite 308 Westborough, MA 01581 www.open.com -----Original Message----- From: Harper, Patrick [mailto:Patrick.Harper () phns com] Sent: Friday, December 31, 2004 4:32 PM To: CraftedPacket () securitynerds org; focus-ids () lists securityfocus com Subject: RE: IDS event filtering -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thresholding is a wonderful thing. And no, I personally do not want to see alerts on tings I do not have. If I am an all apache shop then I do not turn on any IIS rules. I also make sure, via scanning and vulnerability analysis, that I do not in fact have any IIS (or whatever) installed. You first need to have a good inventory of what you have. And you need to keep that up to date so you always know what you have. Then you trim all rules to that. Weather it be ingress - egress firewall rules, IDS configs, or whatever. Figure out what you have, learn how it flows (and make it work/flow the secure way) then monitor it. - -----Original Message----- From: Billy Dodson [mailto:CraftedPacket () securitynerds org] Sent: Friday, December 31, 2004 9:37 AM To: focus-ids () lists securityfocus com Subject: IDS event filtering I am wanting to get an idea of what you guys out there filter from your IDS sensors. Some of the sensors I monitor get TONS of events for MSSQL control overflows. If the customer is patched for slammer and does not have any SQL services on the internet, is it safe to filter out those events? Do you still want to see that traffic even though you know your are not vulnerable? Thanks! - ---------------------------------------------------------------------- - ---- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. - ---------------------------------------------------------------------- - ---- -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQdXFLpiWafDb7+B/EQLkZwCgxqFePWcqpCbc4/gTEuaUJYBY6iYAoOKi xe1e6rLpQeTIU7O+zuW96Fj1 =SkUh -----END PGP SIGNATURE----- Disclaimer: This electronic message, including any attachments, is confidential and intended solely for use of the intended recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have received this message in error, please delete it and notify the sender immediately. ------------------------------------------------------------------------ -- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ -- -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Re: IDS event filtering Stef (Jan 03)
- <Possible follow-ups>
- RE: IDS event filtering dcdave (Jan 03)
- Re: IDS event filtering Reto Baumann (Jan 03)
- Re: IDS event filtering Jeff Kell (Jan 03)
- Re: IDS event filtering M. Dodge Mumford (Jan 03)
- RE: IDS event filtering Evans, Arian (Jan 03)
- Message not available
- RE: IDS event filtering (NeVO comments) Ron Gula (Jan 04)
- Message not available
- RE: IDS event filtering Phil Hollows (Jan 03)
- RE: IDS event filtering Ofer Shezaf (Jan 04)
- RE: IDS event filtering Phil Hollows (Jan 06)
- RE: IDS event filtering Phil Hollows (Jan 06)
- RE: IDS event filtering Ofer Shezaf (Jan 17)