TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Hi
Darryl Luff [mailto:[EMAIL PROTECTED]] wrote on 18th September:
> Where is it documented what each RealSecure signature actually looks for
> to trigger the event? Some of the signatures include this information in
> Signatures.pdf, but others (eg. the TFN2000 one) don't. If it's not
> documented, how do you know when it's real, and when it's a
> false alarm?
It is not documented anywhere - even the information in the various help
files is not 100% accurate. This sort of detail (at least to the level that
we are likely to want) is the 'crown jewels' of any IDS and is unlikely to
be given out for free.
However, I must give full credit to [EMAIL PROTECTED] For specific alerts
they have been most helpful - once I had convinced them that I knew what I
was talking about of course!
I suspect that on a per-alert basis you could get quite a lot of
information,
but that you will not get the 'global' file as this would almost allow you
to build your own IDS, something that would be commercial suicide.
Robert
| Robert Turner
| Microsoft Security
| [EMAIL PROTECTED]
