IDS mailing list archives
RE: IDS Tuning
From: "Arun Vishwanathan" <arun.vishwanathan () nevisnetworks com>
Date: Sun, 12 Mar 2006 08:42:52 +0530
"IDS Tuning" could be defined as Customizing an IDS for ones network. AFAIK "IDS tuning" would largely imply "IDS Signature Set tuning" which further means tweaking/modifying the signature set to reduce false positives and make the IDS more reliable and also faster in some situations. Every network is different in some way or other and hence signatures that are required for a particular network may not be required for another network. For example, if your network does not have APACHE based Web servers then you can disable Apache category in Snort. This kind of tuning may also give you better speed with the IDS. Similarly, an admin would like to disable signatures which are likely to produce too much of false positives in "his" network. I am not sure if there is a document on this or not but to tune an IDS you need to have a good understanding of all App level protocols (SMTP/FTP/Telnet/HTTP etc) and also have a good understanding of the signature set. HTH. Regards, Arun -----Original Message----- From: Naveen Sharma [mailto:naveenkat () gmail com] Sent: Friday, March 10, 2006 2:19 AM To: focus-ids () securityfocus com Subject: IDS Tuning Hi All, What exactly is IDS tuning ? Please provide steps to tune Snort. Thanks in advance. Cordial regards Naveen ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- IDS Tuning Naveen Sharma (Mar 11)
- Re: IDS Tuning lucien Fransman (Mar 14)
- Re: IDS Tuning Devdas Bhagat (Mar 14)
- Re: IDS Tuning Joel Esler (Mar 20)
- <Possible follow-ups>
- RE: IDS Tuning Arun Vishwanathan (Mar 14)