RE: IDS event filtering

["Ofer Shezaf" <Ofer.Shezaf () breach com>]

To add my two cents:

Filtering is not only about yes and no, but also about severity. 

My experience shows that management report should include also a summary
of unsuccessful attacks as they are used for policy creation and
budgeting. In other words, I would like to show my boss that the world
is dangerous, and that it attacks our systems.

On the other hand in real time monitoring that produced actionable items
I would not want to see events that do not pose immediate threat.

The trick in many IDS/SIM systems is to set different severity levels:
information only for non immediate events and high severity to events
that pose immediate threat.

Ofer Shezaf
CTO, Breach Security
Tel: +972.9.956.0036 ext.212
Cell: +972.54.443.1119
ofers () breach com
http://www.breach.com


> -----Original Message-----
> From: Billy Dodson [mailto:CraftedPacket () securitynerds org]
> Sent: Friday, December 31, 2004 5:37 PM
> To: focus-ids () lists securityfocus com
> Subject: IDS event filtering
>
> I am wanting to get an idea of what you guys out there filter from
your
> IDS sensors.  Some of the sensors I monitor get TONS of events for
MSSQL
> control overflows.  If the customer is patched for slammer and does
not
> have any SQL services on the internet, is it safe to filter out those
> events?  Do you still want to see that traffic even though you know
your
> are not vulnerable?  Thanks!
------------------------------------------------------------------------
--
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from
> CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
------------------------------------------------------------------------
--


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------