RE: on NIDS/NIPS tuning

["Darren Webb" <spyder007 () charter net>]

We constantly refine our IDS sigs.  I don't see how anyone could not.

However it wasn't always that way.  When we inherited the system, the
database was so full of false positives that it was completely unusable.  We
pretty much had to start over.

Darren   

-----Original Message-----
From: Anton A. Chuvakin [mailto:anton () chuvakin org] 
Sent: Thursday, June 09, 2005 12:01 PM
To: focus-ids () securityfocus com
Subject: on NIDS/NIPS tuning

All,

I was thinking about some issues with IDS alerts (their volume, etc) and
realized I could use some help from the list. It might also be a  fun
discussion item.

So, here it is: how many folks who buy/download a NIDS/NIPS actually tune
it? Long time ago when I was asking this question the previous time, I was
scared to learn that lots of people do not tune their NIDSs. Is it any
better now?

Best,
--
Anton A. Chuvakin, Ph.D., GCIA, GCIH, GCFA
     http://www.info-secure.org
   http://www.securitywarrior.com


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------