IDS mailing list archives
RE: Snort
From: Bénoni MARTIN <Benoni.MARTIN () libertis ga>
Date: Thu, 30 Sep 2004 17:20:41 +0100
I am afraid there is no way to get rid of ALL the false positives ! When I was dealing with IDS some two years ago, I configured two identical Snorts, one stayed with the default config, and the second one was tunned (by editing snort config file and changing the alerts when necessary) day after day, attack after attack, alert after alert ... to finally get to a well-tuned IDS. Some IDS are better than others as they will give you less false positives, but with an open source as Snort, you will have some work to do tunning it before having an reliable IDS ... HTH :) -----Message d'origine----- De : Jeremy Gonzales [mailto:jerdgonzales () yahoo com] Envoyé : lundi 27 septembre 2004 22:09 À : focus-ids () securityfocus com Objet : Snort Hi, Does anyone have experience with snort reports? How do you deal with the loads of information? Is there a way to generate reports that eliminate the false positives? Any help will be appreciated. Thanks, Jeremy. __________________________________ Do you Yahoo!? Yahoo! Mail - 50x more storage than other providers! http://promotions.yahoo.com/new_mail -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. -------------------------------------------------------------------------- -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------