RE: IDS event filtering

["Harper, Patrick" <Patrick.Harper () phns com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thresholding is a wonderful thing.  And no, I personally do not want
to see alerts on tings I do not have.  If I am an all apache shop
then I do not turn on any IIS rules.  I also make sure, via scanning
and vulnerability analysis, that I do not in fact have any IIS (or
whatever) installed.  You first need to have a good inventory of what
you have.  And you need to keep that up to date so you always know
what you have.  Then you trim all rules to that.  Weather it be
ingress - egress firewall rules, IDS configs, or whatever.  Figure
out what you have, learn how it flows (and make it work/flow the
secure way) then monitor it. 

 
- -----Original Message-----
From: Billy Dodson [mailto:CraftedPacket () securitynerds org] 
Sent: Friday, December 31, 2004 9:37 AM
To: focus-ids () lists securityfocus com
Subject: IDS event filtering

I am wanting to get an idea of what you guys out there filter from
your
IDS sensors.  Some of the sensors I monitor get TONS of events for
MSSQL
control overflows.  If the customer is patched for slammer and does
not
have any SQL services on the internet, is it safe to filter out those
events?  Do you still want to see that traffic even though you know
your
are not vulnerable?  Thanks!

- ----------------------------------------------------------------------
- ----
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks
from 
CORE IMPACT.
Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
- ----------------------------------------------------------------------
- ----




-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQdXFLpiWafDb7+B/EQLkZwCgxqFePWcqpCbc4/gTEuaUJYBY6iYAoOKi
xe1e6rLpQeTIU7O+zuW96Fj1
=SkUh
-----END PGP SIGNATURE-----




Disclaimer:
This electronic message, including any attachments, is confidential and intended solely for use of the intended 
recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by 
applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have 
received this message in error, please delete it and notify the sender immediately. 




--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------