IDS mailing list archives
Re: Intrushield vs. ISS once more...
From: Chris Mills <securinate () gmail com>
Date: Wed, 5 Jan 2005 09:22:35 -0500
The problem I am having is that some packets (usually summary events), in the response tab, there is no option to view the data, but in the configured response tab, "Capture 256 bytes of applicable data" has a green check. Also, when I edit a policy to turn on extended logging, let's say 10 packets for an alert, I cannot view that packet data, even though in the other tab, it says it is logging it. For the packets that will display data, it's great, and I love how it integrates with Ethereal. Chris On Tue, 4 Jan 2005 13:54:36 -0000 (GMT), Chris Brown <chris () get-tuf com> wrote:
I have been trialling Intrushield and it logs and displays packet info just fine, have you installed Ethereal and pointed Intrushield to it's location? Also Intrushield tells you what sig it has fired on in the alert viewer....... Regards Tuffer "I could soar like an Eagle but weasels don't get sucked into jet engines" We have intrushield deployed here, and I am disappointed. The ability to create user-defined signatures is very poor. There is no way to make a signature to look at all ports and protocols, so with a UDS, you must specify a protocol for it to look at. There is no command-line access to write signatures, so you must use their Java GUI. There is no way to import sigs from other vendors, such as snort, and the rule flexibilty is just not there. The built-in signatures is a closed-set, so you do not know what IntruShield's signatures are firing on. You also cannot filter out traffic. There are filters available, but they only work on signature based detection. Anomaly detection will still fire on the filtered traffic. I have yet to get the logging capability to work. You can set it to log X packets, but it won't display them when you view alerts. Hope this helps, Chris On 18 Dec 2004 01:49:19 -0000, Jacob Winston <jctx09_at_yahoo.com> wrote:I have been evaluating Intrushield and ISS but am still unsure on whichroute to take. Does anyone have compelling info on why Intrushield is better or vice-versa? Any help is appreciated.Thank you in advance.-------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
-------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- RE: Intrushield vs. ISS once more... Maynor, David (ISS Atlanta) (Jan 03)
- Re: Intrushield vs. ISS once more... Thomas Ptacek (Jan 06)
- Re: Intrushield vs. ISS once more... Dennis Cox (Jan 06)
- Re: Intrushield vs. ISS once more... Adam Powers (Jan 08)
- Re: Intrushield vs. ISS once more... Thomas Ptacek (Jan 10)
- Re: Intrushield vs. ISS once more... Mike Frantzen (Jan 08)
- <Possible follow-ups>
- RE: Intrushield vs. ISS once more... Murtland, Jerry (Jan 03)
- Re: Intrushield vs. ISS once more... Chris Brown (Jan 04)
- Re: Intrushield vs. ISS once more... Chris Mills (Jan 06)
- Re: Intrushield vs. ISS once more... Jason (Jan 06)
- Re: Intrushield vs. ISS once more... Jason (Jan 06)
- RE: Intrushield vs. ISS once more... Chris Brown (Jan 06)
- Re: Intrushield vs. ISS once more... JM (Jan 08)
- Re: Intrushield vs. ISS once more... Thomas Ptacek (Jan 06)