Snort mailing list archives
Rate of alert
From: Denis Sacchet <mailinglist () kikamedical net>
Date: Fri, 25 Aug 2006 15:31:48 +0200
Hello everybody, I wonder if 60 unique alerts (for about 10000 alerts) is normal for a snort configuration. Moreover, those alerts seems to not correspond every time, and I adjust my rules to filter for example vulnerability on IMAP server type, but my IMAP server is not of this type, IIS attack onto apache web server, etc ... Perhaps something is wrong in the configuration used. Thanks for your point of view and your input about the number of alert and the type; Best regards Denis Sacchet ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Rate of alert Denis Sacchet (Aug 25)
- Re: Rate of alert Patrick S. Harper (Aug 25)
- Re: Rate of alert Joel Esler (Aug 25)
- Re: Rate of alert Patrick S. Harper (Aug 25)