RE: on NIDS/NIPS tuning

["Joshua Berry" <jberry () PENSON COM>]

I tune my IDS sensors for rules that are giving me too many
false-positives, and for any vulnerability or security threat that isn't
addressed with the current rule-set.  I try to go over my rule-set and
configuration every couple of months.

Other than that, I have written a script that I can context.pl that
imports data from nessus scans and p0f profiles (data from these tools
are imported into a database by some custom scripts) and uses that
information to configure some of the variables and rules to attempt to
provide context for the system.  It is somewhat of a hacked together
"poor-mans" attempt at RNA.

-----Original Message-----
From: Anton A. Chuvakin [mailto:anton () chuvakin org] 
Sent: Thursday, June 09, 2005 12:01 PM
To: focus-ids () securityfocus com
Subject: on NIDS/NIPS tuning

All,

I was thinking about some issues with IDS alerts (their volume, etc) and
realized I could use some help from the list. It might also be a  fun
discussion item.

So, here it is: how many folks who buy/download a NIDS/NIPS actually
tune
it? Long time ago when I was asking this question the previous time, I
was
scared to learn that lots of people do not tune their NIDSs. Is it any
better now?

Best,
-- 
Anton A. Chuvakin, Ph.D., GCIA, GCIH, GCFA
     http://www.info-secure.org
   http://www.securitywarrior.com


------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------
--


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------