RE: Good Snort Signatures

["Patrick S. Harper" <patrick () internetsecurityguru com>]

I believe the problem is not in the rules but in the tuning.  It is not an
hour or two process for ANY ids.  I have worked with most of the major
versions in the last 5 years and even worked as an SE for one of the
manufactures.

I find that a lot of people just install snort, crank it up, open acid and
get overwhelmed.  You have variables to define, and you need to do all of
them nit just home and external net.  Then you need to go through and get
rid of the rules that do not mean anything to you.

Patrick S. Harper | CISSP RHCT MCSE
www.internetsecurityguru.com

www.ntsug.org - Snort Users Group

"If there is no light at the end of the tunnel, get down there and light the
damn thing yourself!"
 
-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Adriel T.
Desautels
Sent: Tuesday, August 24, 2004 12:57 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Good Snort Signatures

Greetings List, 
        Does anyone here know where I can find low false positive snort
rules?  The rules from snort.org are simply bunk.  They generate way too
many false positives and even false negatives during certain types of
events. I am not adverse to purchasing snort rules either, I just need
something that works.



-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk
Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off
Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users