RE: IDS ISS

[<PPowenski () oag com>]

Wholeheartily agree....
Have had several years experience with ISS.
Snort has been solid here for over two years, updates to the current
release have been performed since 1.8.7 which have been smooth, reliable
and very flexible. Upgraded from ACID to BASE and now setting up SGUIL
again with no difficulties.
Sourcefire is doing some very interesting and innovative work with snort
as its detection engine. 

If you plan on pursing ISS look very, very, carefully at the setup,
restrictions i.e. what parts can be loaded onto a single box and what
order they need to be installed and upgraded, architecture requirements,
and how much work it will be to keep it running.

Have setup Snort on every platform that it is distributed for, in every
combination i.e. web, db, on the sensor or on another box and have not
had any issues. You need to consider performance and the amount of
traffic for various configurations.






-----Original Message-----
From: Joel Esler [mailto:eslerj () gmail com] 
Sent: 20 May 2005 12:58
To: THolman () toplayer com
Cc: anatole.berteau () turbomeca fr; focus-ids () securityfocus com
Subject: Re: IDS ISS


I concur.  I would always go with Snort over ISS anyday.  I've tested  
and ran both at the same time on the same network, and Snort not only  
out performs, but it would be much easier to look at the data and  
configure the IDS.  (Or IPS..  Look into Snort-inline)

Joel Esler

On May 19, 2005, at 8:11 PM, THolman () toplayer com wrote:

> Hi Anatole,
>
> What was wrong with Snort?
> There are plenty of implementations possible and it is highly tunable,
> plus
> you get to see the signatures.
> If it's performance you're worried about, consider running on a  
> platform
> such as SourceFire.
> Is it purely a detection-based solution you're looking for, or do you

> have
> the means to prevent intrusions inline already?
>
> Regards,
>
> Tim
>
> -----Original Message-----
> From: Berteau Anatole [mailto:anatole.berteau () turbomeca fr]
> Sent: 17 May 2005 17:03
> To: focus-ids () securityfocus com
> Subject: IDS ISS
>
>
>
> Hello,
>
> I'm testing IDS solution. After Snort, i'm beginning to work with ISS.
>
> What's the minimum architecture to use ISS? Is it possible to use only
> a
> network sensor? If this solution is available, what's the solution to
> consult alerts?
>
> Thanks
>
> Anatole
>
> ----------------------------------------------------------------------
> -
> ---
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from

> CORE IMPACT. Go to
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
----------------------------------------------------------------------- 
> ---
>
> ----------------------------------------------------------------------
> -
> ---
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from

> CORE IMPACT. Go to
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
----------------------------------------------------------------------- 
> ---


------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------
--
NOTICE: This e-mail is intended for the named recipient(s). It may contain privileged and/or confidential information. 
If you are not one of the intended recipients, please notify the sender immediately and destroy this e-mail and 
attachment(s): you must not copy, distribute, retain or take any action in reliance upon the email or attachment(s). 
While all reasonable efforts are made to safeguard inbound and outbound e-mails, OAG Worldwide Ltd and its affiliate 
companies cannot guarantee that attachments are virus-free or are compatible with your systems, and does not accept 
liability in respect of viruses or computer problems experienced. Thank you.


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------