Yes, ISS has document called PAM.chm that can be found in KB #2190.

Hope that it's what you need, but remmember, that listed configured params
are not all!
---
Best regards, Sergey V. Soldatov.
Information security department.


                                                                                
                                    
              "Soda, Marc"                                                      
                                    
              <[EMAIL PROTECTED]>         To:       "'[email protected]'" 
<[email protected]>                    
              Sent by:                         cc:                              
                                    
              [EMAIL PROTECTED]         Subject:  [ISSForum] Signature tuning   
                             
                                                                                
                                    
                                                                                
                                    
              20.12.2004 21:23                                                  
                                    
                                                                                
                                    
                                                                                
                                    




Hello all,

Is anyone aware of documentation or resources for tuning specific IDS
signatures?  I'm trying to eliminate a high number of false positives.

Thanks,
--
Marc Soda, CISSP
Information Security Engineer
NCO Group
215.441.2189


_______________________________________________
ISSForum mailing list
[email protected]

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.





_______________________________________________
ISSForum mailing list
[email protected]

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]

The ISSForum mailing list is hosted and managed by Internet Security Systems, 
6303 Barfield Road, Atlanta, Georgia, USA 30328.

Reply via email to