Snort mailing list archives
RE: only the "important stuff"
From: SN ORT <snort_on_acid () yahoo com>
Date: Tue, 26 Oct 2004 10:15:31 -0700 (PDT)
What?! You mean, send him all of the positive alerts? Impossible without human intervention/correlation. You could move some sensors back or set some variables that look at only important machines, or even setup another instance of Snort that runs only custom signatures you're sure never produce false positives/negative..etc, but then you could very well miss some legitimate break-ins. You could also try to customize the IDS so that each signature is customized to vulnerable servers. IOW, why would I want to receive an IIS vulnerability alert when my server is running apache? So I would set a var $apache_servers=IPaddress(range) and then set each Apache signature to destination = "$apache_servers", and at the same time have the IIS signatures only relate to IIS servers. Wow, there's a concept. Nah, you'd have to have a brain look at those first, and then send them to your presidente (although products like from ISS contain correlation capabilities) Cheese! Marc --__--__-- Message: 9 Date: Tue, 26 Oct 2004 09:34:56 -0700 From: Steven Crandell <steven.crandell () gmail com> Reply-To: Steven Crandell <steven.crandell () gmail com> To: snort-users () lists sourceforge net Subject: [Snort-users] only the "important stuff" Hi all, I have snort running the way I want it to run, etc. I'm also using logcheck to watch the logs and email me when someone exceeds my thresholds. Anyway, I'm pretty satisfied with how all of that is working. This morning the president of the co. has asked that he -not- receive the day to day alerts and would only like to receive alerts on "successful" intrusions. Are there certain rules that would never be triggered unless someone actually gets into a monitored system? Or anything along those lines? I know this is a little off the wall, but any help/suggestions would be greatly appreciated. regards, -- Steven Crandell steven.crandell () gmail com __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail ------------------------------------------------------- This SF.Net email is sponsored by: Sybase ASE Linux Express Edition - download now for FREE LinuxWorld Reader's Choice Award Winner for best database on Linux. http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- only the "important stuff" Steven Crandell (Oct 26)
- Re: only the "important stuff" Jason Haar (Oct 26)
- <Possible follow-ups>
- RE: only the "important stuff" SN ORT (Oct 26)
- RE: only the "important stuff" M. Shirk (Oct 26)
- RE: only the "important stuff" Jacques Brierre (Oct 26)
- RE: only the "important stuff" Orit Vidas (Oct 26)