RE: IDS event filtering

["Phil Hollows" <phollows () open com>]

AFAIK this is the best list on securityfocus for SIM.  The management
and incident handling lists appear to be moribund.  There's also
occasional SIM-related traffic on the logs list at shmoo.com.  If there
are other lists that folks like to track for activity related to SIM, do
suggest them here.

Otherwise, would anyone be interested in a separate SIM list at
securityfocus?  If there's enough interest (vote now!) I suppose we can
get one started. Otherwise it seems to me that this is the right place,
given the overlap in the goals of SIM and IDS/IPS.

Phil Hollows 
VP Marketing 
OpenService, Inc.
110 Turnpike Road, Suite 308 
Westborough, MA 01581 
www.open.com 


-----Original Message-----
From: Stuart Staniford [mailto:stuart () nevisnetworks com] 
Sent: Tuesday, January 04, 2005 1:21 AM
To: Phil Hollows; 'Harper, Patrick'; CraftedPacket () securitynerds org;
focus-ids () lists securityfocus com
Subject: RE: IDS event filtering

Is there any mailing list for discussion of SIMs, or does that pretty
much
fit under this list still?  (There's quite a bit of overlap in concepts
and
technology).

Stuart.

Stuart Staniford, Principal Scientist
Nevis Networks
stuart () nevisnetworks com
408-327-4652



> -----Original Message-----
> From: Phil Hollows [mailto:phollows () open com] 
> Sent: Monday, January 03, 2005 7:13 AM
> To: Harper, Patrick; CraftedPacket () securitynerds org; 
> focus-ids () lists securityfocus com
> Subject: RE: IDS event filtering
>
>
> // vendor response
>
> You can use a SIM to correlate your IDS alarms with your VA scans in
> real time to strip out alerts that don't matter (patched 
> systems) while
> retaining the ability to get warnings of rogue MSSQL systems (perhaps
> embedded in 3rd party products installed by your users).  There are
> several products on the market, including my company's, OpenService.
> Depending on the approach, you don't have to do a detailed inventory
> first - SIMs can pick up the details from network traffic and the VA
> scan, as well as metadata inputs from you.  
>
> Thank you,
>
> Sincerely,
>
> Phil Hollows
> VP Marketing 
> OpenService, Inc.
> 110 Turnpike Road, Suite 308 
> Westborough, MA 01581 
> www.open.com 
>
>
> -----Original Message-----
> From: Harper, Patrick [mailto:Patrick.Harper () phns com] 
> Sent: Friday, December 31, 2004 4:32 PM
> To: CraftedPacket () securitynerds org; focus-ids () lists securityfocus com
> Subject: RE: IDS event filtering
>
>  
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Thresholding is a wonderful thing.  And no, I personally do not want
> to see alerts on tings I do not have.  If I am an all apache shop
> then I do not turn on any IIS rules.  I also make sure, via scanning
> and vulnerability analysis, that I do not in fact have any IIS (or
> whatever) installed.  You first need to have a good inventory of what
> you have.  And you need to keep that up to date so you always know
> what you have.  Then you trim all rules to that.  Weather it be
> ingress - egress firewall rules, IDS configs, or whatever.  Figure
> out what you have, learn how it flows (and make it work/flow the
> secure way) then monitor it. 
>
>  
> - -----Original Message-----
> From: Billy Dodson [mailto:CraftedPacket () securitynerds org] 
> Sent: Friday, December 31, 2004 9:37 AM
> To: focus-ids () lists securityfocus com
> Subject: IDS event filtering
>
> I am wanting to get an idea of what you guys out there filter from
> your
> IDS sensors.  Some of the sensors I monitor get TONS of events for
> MSSQL
> control overflows.  If the customer is patched for slammer and does
> not
> have any SQL services on the internet, is it safe to filter out those
> events?  Do you still want to see that traffic even though you know
> your
> are not vulnerable?  Thanks!
>
> - 
> ----------------------------------------------------------------------
> - ----
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks
> from 
> CORE IMPACT.
> Go to
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> - 
> ----------------------------------------------------------------------
> - ----
>
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.1
>
> iQA/AwUBQdXFLpiWafDb7+B/EQLkZwCgxqFePWcqpCbc4/gTEuaUJYBY6iYAoOKi
> xe1e6rLpQeTIU7O+zuW96Fj1
> =SkUh
> -----END PGP SIGNATURE-----
>
>
>
>
> Disclaimer:
> This electronic message, including any attachments, is 
> confidential and
> intended solely for use of the intended recipient(s). This message may
> contain information that is privileged or otherwise protected from
> disclosure by applicable law. Any unauthorized disclosure,
> dissemination, use or reproduction is strictly prohibited. If you have
> received this message in error, please delete it and notify the sender
> immediately. 
>
>
>
>
> --------------------------------------------------------------
> ----------
> --
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world 
> attacks from 
> CORE IMPACT.
> Go to 
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
>
> to learn more.
> --------------------------------------------------------------
> ----------
> --
>
>
> --------------------------------------------------------------
> ------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world 
> attacks from 
> CORE IMPACT.
> Go to 
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> --------------------------------------------------------------
> ------------


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------