Re: What makes a complete IDS package?

[Joel Esler <jesler () sourcefire com>]

Clarify --

I have those rules set to drop, and the alert suppressed (still recorded in
tcpdump logs).  If a website is hiding the information as such with
Javascript or whatever, I don't need to go to that website.

J

On Sat, Mar 19, 2011 at 10:09 AM, Joel Esler <jesler () sourcefire com> wrote:

> I don't.  No.  I have those set to block in the IPS.
>
>
> On Mar 19, 2011, at 9:58 AM, James Lay wrote:
>
>
> I review my events on the command line.  I don't use a DB or whatever.
>  I've tuned the hell out of my Snort installation, so that when it alerts, I
> need to deal with something.
>
> Joel
>
>
> Joel,
>
> So….do you nuke out the "possible" rules?  Or the "likely hostile" rules?
>  I spend a fair amount of time tracking down obfuscated javascript and
> javascript in pdf type alerts…most are non-malicious, but some turn out to
> be bad…curious on just how much you've tuned my friend ;)
>
> James
>
>
> ------------------------------------------------------------------------------
> Colocation vs. Managed Hosting
> A question and answer guide to determining the best fit
> for your organization - today and in the future.
>
> http://p.sf.net/sfu/internap-sfd2d_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> --
>
> Joel Esler
> jesler () sourcefire.com
> http://blog.snort.org && http://blog.clamav.net
> Twitter: @snort


-- 
Joel Esler | http://blog.snort.org | http://vrt-blog.snort.org |
http://blog.clamav.net

------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users