IDS mailing list archives
Re: IDS detection approaches
From: randy () procyonlabs com
Date: Fri, 12 Oct 2007 12:00:38 -0400
So it is "open" to any paying customer of Cisco? What makes Cisco's IDS rules "open" then? I ask because the abuse of the term is overwhelming. It is my understanding that "open" means the technology plays well with others, using standardized popular methodology shared amongst the community. Now, I do have a valid CCO account, but we have no IDS devices on the contracts. Can I still download the rules, despite the warnings given that I must have a specific contract/license to do so? Thanks, Randy
Anyone with a valid license is able to download the signatures to be placed on your Cisco sensor. Once you have placed them on your sensor, you are free to open/edit/manipulate or add to the signatures at will. Open signatures does not mean they are "open source" or free. Without a Cisco sensor, they won't be much use to you. If you have a CCO account, you can download the signatures at: http://www.cisco.com/cgi-bin/tablebuild.pl/ips6-sigup Gary On 10/12/07 9:59 PM, "Randal T. Rioux" <randy () procyonlabs com> wrote:Gary Halleen wrote: <snip>Additionally, all Cisco IPS signatures are open. You are able to view all or most fields of signatures, create your own, and modify existing signatures. You do not need to wait for Cisco to release new signaturesifyou have sufficient IDS/IPS skills to write a new signature. If you can write a snort rule, you can write a Cisco IPS signature.Open? Really? Where can I download them? Thanks, Randy------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro _sfw to learn more. ------------------------------------------------------------------------
------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
Current thread:
- RE: IDS detection approaches, (continued)
- RE: IDS detection approaches Nelson Brito (Oct 10)
- Re: IDS detection approaches Sec urity (Oct 10)
- Message not available
- Re: IDS detection approaches Sec urity (Oct 12)
- RE: IDS detection approaches Nelson Brito (Oct 12)
- Re: IDS detection approaches Sec urity (Oct 12)
- RE: IDS detection approaches Nelson Brito (Oct 12)
- Re: IDS detection approaches Jason (Oct 12)
- RE: IDS detection approaches Nelson Brito (Oct 15)
- Re: IDS detection approaches Jason (Oct 15)
- Re: IDS detection approaches Gary Halleen (Oct 15)
- RE: IDS detection approaches Marcio (Oct 18)