All,
Lately I've been working on tuning server sensors deployed on Windows
servers. With pam.report.filter.<issueid> in the advanced parameters
settings I can quiet some noisy applications by ignoring specific sigs
from specific source IP addresses. But in some cases that still isn't
granular enough. For instance, for an application that makes many
connections on, say, TCP/9999, may set off TCP_Probe_Other because it
surpasses the threshhold for that sig. I could, if I wanted to, dial
back the threshholds in the advanced settings for that sig. But I'm
concerned I might introduce false negatives because that setting would
apply to ALL ports. What I'd really like is an extension to
pam.report.filter that allows the server sensor to ignore an issueid
from a specific source IP address when combined with a specific
destination port.
I've looked through the docs but I haven't found any way to do anything
that granular. Does anyone know if this is possible?
TIA
Jason Baeder
__________________________________
Yahoo! Music Unlimited
Access over 1 million songs. Try it free.
http://music.yahoo.com/unlimited/
_______________________________________________
ISSForum mailing list
[email protected]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
