Re: Intrushield vs. ISS once more...

[Jason <security () brvenik com>]

Chris Brown wrote:
> Intrushield sends alerts to a central management server, Ethereal needs to
> be installed on this.  Alerts are presented in a console and if you wish to
> drill down to view the captured packets Ethereal opens and is used to read
> the packets.  During the install of the Intrushield manager software you
> simply tell Intrushield the location of Ethereal.exe on your system.
>
> So in answer to your Q, it is neither 1 or 2.

So you must have access to the central server in order to perform 
effective analysis? Is there not the concept of multiple people 
performing analysis?


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------