Intrusion Detection Systems

learn more… | top users | synonyms (2)

1
vote
1answer
165 views

What is your experience with AlertLogic?

Do you have any insight, or experience (good or bad) regarding AlertLogic? In what areas can they improve, what areas are they lagging in?
5
votes
3answers
623 views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
7
votes
3answers
408 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
6
votes
4answers
571 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
5
votes
2answers
139 views

Managing a team of IDS experts; how would you orgainze your team?

Suppose you are managing a team of Intrusion Detection Experts: ...what are the functional areas of the IDS knowledge space would you group your team into? ...how would you structure your team? ...
8
votes
3answers
490 views

What FOSS software do you like to use to build intrusion detection stacks?

Start-ups and organizations with limited budgets that are security conscious are often encouraged to deploy intrusion detection stacks. Given that prevention will always fail, intrusion detection ...
22
votes
8answers
8k views

Can I detect web app attacks by viewing my Apache log file?

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
11
votes
3answers
288 views

What are the pros/cons of using a threat detection system?

What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)? What does a properly implemented threat detection system do and how does it behave when it detects ...