[Snort-users] only the "important stuff"
snort_on_acid at ...131...
Tue Oct 26 10:18:01 EDT 2004
What?! You mean, send him all of the positive alerts?
Impossible without human intervention/correlation.
You could move some sensors back or set some variables
that look at only important machines, or even setup
another instance of Snort that runs only custom
signatures you're sure never produce false
positives/negative..etc, but then you could very well
miss some legitimate break-ins. You could also try to
customize the IDS so that each signature is customized
to vulnerable servers. IOW, why would I want to
receive an IIS vulnerability alert when my server is
running apache? So I would set a var
$apache_servers=IPaddress(range) and then set each
Apache signature to destination = "$apache_servers",
and at the same time have the IIS signatures only
relate to IIS servers. Wow, there's a concept.
Nah, you'd have to have a brain look at those first,
and then send them to your presidente (although
products like from ISS contain correlation
Date: Tue, 26 Oct 2004 09:34:56 -0700
From: Steven Crandell <steven.crandell at ...11827...>
Reply-To: Steven Crandell <steven.crandell at ...11827...>
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] only the "important stuff"
I have snort running the way I want it to run, etc.
I'm also using
logcheck to watch the logs and email me when someone
thresholds. Anyway, I'm pretty satisfied with how all
of that is
This morning the president of the co. has asked that
he -not- receive
the day to day alerts and would only like to receive
Are there certain rules that would never be triggered
actually gets into a monitored system? Or anything
along those lines?
I know this is a little off the wall, but any
be greatly appreciated.
steven.crandell at ...11827...
Do you Yahoo!?
Yahoo! Mail Address AutoComplete - You start. We finish.
More information about the Snort-users