Re: What makes a complete IDS package?

["Jefferson, Shawn" <Shawn.Jefferson () bcferries com>]

Is this in a business or just personal?  There's no way I could do that in my environment... too many legitimate things 
would get blocked.

________________________________
From: Joel Esler [mailto:jesler () sourcefire com]
Sent: Monday, March 21, 2011 9:34 AM
To: James Lay
Cc: Snort
Subject: Re: [Snort-users] What makes a complete IDS package?

Clarify --

I have those rules set to drop, and the alert suppressed (still recorded in tcpdump logs).  If a website is hiding the 
information as such with Javascript or whatever, I don't need to go to that website.

J

On Sat, Mar 19, 2011 at 10:09 AM, Joel Esler <jesler () sourcefire com<mailto:jesler () sourcefire com>> wrote:
I don't.  No.  I have those set to block in the IPS.


On Mar 19, 2011, at 9:58 AM, James Lay wrote:


I review my events on the command line.  I don't use a DB or whatever.  I've tuned the hell out of my Snort 
installation, so that when it alerts, I need to deal with something.

Joel


Joel,

So....do you nuke out the "possible" rules?  Or the "likely hostile" rules?  I spend a fair amount of time tracking 
down obfuscated javascript and javascript in pdf type alerts...most are non-malicious, but some turn out to be 
bad...curious on just how much you've tuned my friend ;)

James

------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net<mailto:Snort-users () lists sourceforge net>
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

--

Joel Esler
jesler () sourcefire.com<http://sourcefire.com>
http://blog.snort.org && http://blog.clamav.net
Twitter: @snort




--
Joel Esler | http://blog.snort.org | http://vrt-blog.snort.org | http://blog.clamav.net


------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users