I
finally managed to get TRONS configured and running with ISS. The one
major anomaly that occurs is often a TRONS signature will alert but will negate
ISS from firing the alert or vice versa. TRONS could be put to better use
if only signatures that are completely independent from any signatures used by
ISS were used in the TRONS configuration. There were situations where an
event should have fired an alert but neither one of them did, so the behavior
using TRONS is erratic.
-----Original Message-----
From: Wansbrough, Tim [mailto:[EMAIL PROTECTED]]
Sent: Friday, October 18, 2002 8:10 AM
To: [EMAIL PROTECTED]
Subject: [ISSForum] Trons Engine.
Hi All,
What are the perceived benefits of using the Trons engine - and what is the performance impact of running a full SNORT library of sigs on the engine?
Regards
Tim
