I think it is not so. You can filter events by using the advanced parameter trust.pair or trust.issue as it in BlackICE by editing config files on sensor. The only diff between filtering in NS rather than in SS is that it is not defined in the gui of the policy editor.
More info is available on http://documents.iss.net/literature/BlackICE/BI-AAG_70.pdf Check out pages 24 and 25. http://documents.iss.net/literature/RealSecure/RS_SvrSensor_Adv_Tuning_R eference_Windows.pdf http://documents.iss.net/literature/RealSecure/nsAdv_Tuning_Reference.pdf --- Best regards, Sergey V. Soldatov. Information security department. [EMAIL PROTECTED] Sent by: To: "Michael Nurre" <[EMAIL PROTECTED]> [EMAIL PROTECTED] cc: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: Re: [ISSForum] Realsecure Server Sensor - Network Filtering 08.10.2004 15:49 No you cannot. I have actually been requesting this from ISS for a little over three years. Thanks, David M Simpson Risk Management Enterprise Security Intrusion Detection Lead American Electric Power 614.716.3139 [EMAIL PROTECTED] "Michael Nurre" <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 10/07/2004 03:48 PM To: [EMAIL PROTECTED] cc: Subject: [ISSForum] Realsecure Server Sensor - Network Filtering Does anyone know if it is possible to filter out specific IP addresses for different signatures on the Server Sensor 7.0 like you can with the Network Sensor? I would think it possible by editing some of the ini files under the BlackIce directory on the server sensor installation. _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
