IDS mailing list archives
RE: IDS event filtering
From: "Ofer Shezaf" <Ofer.Shezaf () breach com>
Date: Thu, 13 Jan 2005 22:22:03 -0500
Or to build an adaptive system: one that would automatically compensate for the dynamic nature of networks, application and threats. Not easy, but we are certainly trying. ~ Ofefr Ofer Shezaf CTO, Breach Security Tel: +972.9.956.0036 ext.212 Cell: +972.54.443.1119 ofers () breach com http://www.breach.com
-----Original Message----- From: Phil Hollows [mailto:phollows () open com] Sent: Tuesday, January 04, 2005 5:57 PM To: Ofer Shezaf; focus-ids () lists securityfocus com Subject: RE: IDS event filtering Part of the issue with any set of filters, especially ones that are manually managed, is that you create an ongoing management burden (and associated structural, recurring cists) as threats, hosts and vulnerabilities change. The trick with IDS and SIM is to find an approach, such as risk analysis, that enables you to automate this process when tied together with some kind of subscription service, which should dramatically
reduce
your maintenance burden, yielding the severity reports Ofer mentions. FWIW Phil Hollows VP Marketing OpenService, Inc. 110 Turnpike Road, Suite 308 Westborough, MA 01581 http://www.open.com -----Original Message----- From: Ofer Shezaf [mailto:Ofer.Shezaf () breach com] Sent: Tuesday, January 04, 2005 5:41 AM To: focus-ids () lists securityfocus com Subject: RE: IDS event filtering To add my two cents: Filtering is not only about yes and no, but also about severity. My experience shows that management report should include also a
summary
of unsuccessful attacks as they are used for policy creation and budgeting. In other words, I would like to show my boss that the world is dangerous, and that it attacks our systems. On the other hand in real time monitoring that produced actionable
items
I would not want to see events that do not pose immediate threat. The trick in many IDS/SIM systems is to set different severity levels: information only for non immediate events and high severity to events that pose immediate threat. Ofer Shezaf CTO, Breach Security Tel: +972.9.956.0036 ext.212 Cell: +972.54.443.1119 ofers () breach com http://www.breach.com-----Original Message----- From: Billy Dodson [mailto:CraftedPacket () securitynerds org] Sent: Friday, December 31, 2004 5:37 PM To: focus-ids () lists securityfocus com Subject: IDS event filtering I am wanting to get an idea of what you guys out there filter fromyourIDS sensors. Some of the sensors I monitor get TONS of events forMSSQLcontrol overflows. If the customer is patched for slammer and doesnothave any SQL services on the internet, is it safe to filter out
those
events? Do you still want to see that traffic even though you knowyourare not vulnerable? Thanks!
------------------------------------------------------------------------
--Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks
from
CORE IMPACT. Go tohttp://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708to learn more.
------------------------------------------------------------------------
--
------------------------------------------------------------------------
-- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
------------------------------------------------------------------------ --
Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------ -- -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- RE: IDS event filtering, (continued)
- RE: IDS event filtering dcdave (Jan 03)
- Re: IDS event filtering Reto Baumann (Jan 03)
- Re: IDS event filtering Jeff Kell (Jan 03)
- Re: IDS event filtering M. Dodge Mumford (Jan 03)
- RE: IDS event filtering Evans, Arian (Jan 03)
- Message not available
- RE: IDS event filtering (NeVO comments) Ron Gula (Jan 04)
- Message not available
- RE: IDS event filtering Phil Hollows (Jan 03)
- RE: IDS event filtering Ofer Shezaf (Jan 04)
- RE: IDS event filtering Phil Hollows (Jan 06)
- RE: IDS event filtering Phil Hollows (Jan 06)
- RE: IDS event filtering Ofer Shezaf (Jan 17)