"IDS Tuning" could be defined as Customizing an IDS for ones network.
AFAIK "IDS tuning" would largely imply "IDS Signature Set tuning" which further means tweaking/modifying the signature set to reduce false positives and make the IDS more reliable and also faster in some situations. Every network is different in some way or other and hence signatures that are required for a particular network may not be required for another network. For example, if your network does not have APACHE based Web servers then you can disable Apache category in Snort. This kind of tuning may also give you better speed with the IDS. Similarly, an admin would like to disable signatures which are likely to produce too much of false positives in "his" network. I am not sure if there is a document on this or not but to tune an IDS you need to have a good understanding of all App level protocols (SMTP/FTP/Telnet/HTTP etc) and also have a good understanding of the signature set. HTH. Regards, Arun -----Original Message----- From: Naveen Sharma [mailto:[EMAIL PROTECTED] Sent: Friday, March 10, 2006 2:19 AM To: [email protected] Subject: IDS Tuning Hi All, What exactly is IDS tuning ? Please provide steps to tune Snort. Thanks in advance. Cordial regards Naveen ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
