IDS mailing list archives
Re: IDS event filtering
From: "M. Dodge Mumford" <dodge () nfr net>
Date: Mon, 3 Jan 2005 09:50:30 -0500
Billy Dodson said:
I am wanting to get an idea of what you guys out there filter from your IDS sensors. Some of the sensors I monitor get TONS of events for MSSQL control overflows. If the customer is patched for slammer and does not have any SQL services on the internet, is it safe to filter out those events? Do you still want to see that traffic even though you know your are not vulnerable? Thanks!
From a vendor's perspective, filtering becomes rather messy. Some customers (As Patrick Harper put it) don't want to see IIS attacks against apache servers (or similar issues). Some customers simply don't want to be told about Big Issues that were patched long ago. Others want to track and profile every attacker. The question "what is safe" is dependent on the risks that the site deems acceptable. I think it's fair to say that most attacks happen over TCP, and, given the current state of TCP initial sequence numbers, the source will be correct. However, the attack you've pointed out occurred via UDP and the source was spoofed. If it's impossible for any machine to be brought onto your network that would be susceptible to -- or infected with blaster -- then it may be advisable to disable the check. But if people bring laptops in, the risk analysis would have to take that into account. -- Dodge
Attachment:
_bin
Description:
Current thread:
- Re: IDS event filtering Stef (Jan 03)
- <Possible follow-ups>
- RE: IDS event filtering dcdave (Jan 03)
- Re: IDS event filtering Reto Baumann (Jan 03)
- Re: IDS event filtering Jeff Kell (Jan 03)
- Re: IDS event filtering M. Dodge Mumford (Jan 03)
- RE: IDS event filtering Evans, Arian (Jan 03)
- Message not available
- RE: IDS event filtering (NeVO comments) Ron Gula (Jan 04)
- Message not available
- RE: IDS event filtering Phil Hollows (Jan 03)
- RE: IDS event filtering Ofer Shezaf (Jan 04)
- RE: IDS event filtering Phil Hollows (Jan 06)
- RE: IDS event filtering Phil Hollows (Jan 06)
- RE: IDS event filtering Ofer Shezaf (Jan 17)