TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Arggh..
OK..
you can send enhancement requests to [EMAIL PROTECTED]
If you need a threshold changed, contact ISS tech support and they will
assist with tuning of your IDS, if it requires more than a couple of hints,
I suggest contacting their professional services department or seek some
3rd party high end consulting service company specializing in IDS.. :)
/mark
At 04:12 PM 9/19/00 +0000, Chris St. Clair wrote:
>TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
>[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
>----------------------------------------------------------------------------
>
>>Signatures.pdf, but others (eg. the TFN2000 one) don't. If it's not
>>documented, how do you know when it's real, and when it's a false >alarm?
>
>Well, you don't. You're basically left to tuning the sigs as best
>you can to decrease the number of false positives.
>
>I've used RS since 2.0 and this has always been a sticking point for
>me with RS. Not all of the sigs are adjustable, and adjusting the
>wrong way can lead to 1) too many false positives to track down if you
>tune it too "rich" or, B) not picking up actual attacks because you
>tuned it to "lean".
>
>I understand that the sig definitions are proprietary and publishing
>the details would allow others to copy them and create an IDS based
>on their work. However, that excuse doesn't help me very much at all.
>
>If you're looking for a fully customizeable IDS that you can have
>full access to sig decodes look into NFR or SHADOW. Granted, you may
>have to do a bit of sig writing yourself, but at least with those you
>actually have that option.
>
>-chris
>_________________________________________________________________________
>Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
>
>Share information about yourself, create your own public profile at
>http://profiles.msn.com.
>
>
