Re: What makes a complete IDS package?

[Joel Esler <jesler () sourcefire com>]

I don't.  No.  I have those set to block in the IPS.


On Mar 19, 2011, at 9:58 AM, James Lay wrote:

> I review my events on the command line.  I don't use a DB or whatever.  I've tuned the hell out of my Snort 
> installation, so that when it alerts, I need to deal with something.
>
> Joel
>
>
> Joel,
>
> So….do you nuke out the "possible" rules?  Or the "likely hostile" rules?  I spend a fair amount of time tracking 
> down obfuscated javascript and javascript in pdf type alerts…most are non-malicious, but some turn out to be 
> bad…curious on just how much you've tuned my friend ;)
>
> James
>
> ------------------------------------------------------------------------------
> Colocation vs. Managed Hosting
> A question and answer guide to determining the best fit
> for your organization - today and in the future.
> http://p.sf.net/sfu/internap-sfd2d_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

--
Joel Esler
jesler () sourcefire.com
http://blog.snort.org && http://blog.clamav.net
Twitter: @snort

------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users