IDS mailing list archives
Re: IDS event filtering
From: Stef <stefmit () gmail com>
Date: Sat, 1 Jan 2005 08:00:56 -0600
I won't filter out anything. Something you do not [know of] have[ing] does not guarantee anything (e.g. you know you do not have MSSQL anywhere on your network, until a vendor comes up to your shop, with a laptop running it, or a product has it "embedded" in its functionality). What I would do would be to only alert on what I have on my network, but log absolutely everything else. A CD or even DVD burner is not expensive these days, compared too the advantage of salvaging information, and I have had first hand experience with having gone back to logs, then identifying and analyzing issues I have never had rules or have not alerted for. My $0.02, Stef On Fri, 31 Dec 2004 15:31:32 -0600, Harper, Patrick <Patrick.Harper () phns com> wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thresholding is a wonderful thing. And no, I personally do not want to see alerts on tings I do not have. If I am an all apache shop then I do not turn on any IIS rules. I also make sure, via scanning and vulnerability analysis, that I do not in fact have any IIS (or whatever) installed. You first need to have a good inventory of what you have. And you need to keep that up to date so you always know what you have. Then you trim all rules to that. Weather it be ingress - egress firewall rules, IDS configs, or whatever. Figure out what you have, learn how it flows (and make it work/flow the secure way) then monitor it. - -----Original Message----- From: Billy Dodson [mailto:CraftedPacket () securitynerds org] Sent: Friday, December 31, 2004 9:37 AM To: focus-ids () lists securityfocus com Subject: IDS event filtering I am wanting to get an idea of what you guys out there filter from your IDS sensors. Some of the sensors I monitor get TONS of events for MSSQL control overflows. If the customer is patched for slammer and does not have any SQL services on the internet, is it safe to filter out those events? Do you still want to see that traffic even though you know your are not vulnerable? Thanks!
-------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- Re: IDS event filtering Stef (Jan 03)
- <Possible follow-ups>
- RE: IDS event filtering dcdave (Jan 03)
- Re: IDS event filtering Reto Baumann (Jan 03)
- Re: IDS event filtering Jeff Kell (Jan 03)
- Re: IDS event filtering M. Dodge Mumford (Jan 03)
- RE: IDS event filtering Evans, Arian (Jan 03)
- Message not available
- RE: IDS event filtering (NeVO comments) Ron Gula (Jan 04)
- Message not available
- RE: IDS event filtering Phil Hollows (Jan 03)
- RE: IDS event filtering Ofer Shezaf (Jan 04)
- RE: IDS event filtering Phil Hollows (Jan 06)
- RE: IDS event filtering Phil Hollows (Jan 06)