IDS mailing list archives

Newbie question: autoblocking with IDS/IPS

From: Daniel <somebody1 () gmx net>
Date: 10 Dec 2004 15:47:36 -0000



Hi,

I'm thinking of buying one of that new CISCO IDS boxes which can be placed inline in the future.

Is anybody of you using the automatic shunning (I guess it's called so) feature of the CISCO IDS? 
Does this make sense? (Which signatures should be autoblocked?)

Or are you just monitoring and then blocking manually?

Any hint would be greatly appreciated!
-Daniel



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------

Current thread:

Newbie question: autoblocking with IDS/IPS Daniel (Dec 13)
- Re: Newbie question: autoblocking with IDS/IPS Mike Johnson (Dec 16)
  - RE: Newbie question: autoblocking with IDS/IPS Gary Halleen (ghalleen) (Dec 17)
- CISCOs new IPS Christoph Pertl (tm011081) (Dec 16)
  - Re: CISCOs new IPS p z (Dec 17)
    - Tippingpoint IPS Christoph Pertl(tm011081) (Dec 23)
    - Re: Tippingpoint IPS Bob Walder (Dec 27)
    - Re: Tippingpoint IPS Paul Schmehl (Dec 27)