Based on your described requirement, you are looking in the wrong direction because IDSs do not provide you with a profile of the patch level of individual nodes.
There are two ways (automated or manual) to tackle your need. The manual method involves either scanning the machine to identify missing patches (eg. Nessus or MBSA) or triggering an update on the machine itself (eg. Windows Update). The automated alternative involves deploying a patch management solution (eg. PatchLink, Citadel Hercules or SUS/SMS) or a quarantining solution that does not allow a machine with network access until a predefined patch level is met. ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
