Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

4
votes
1answer
371 views

Attacks against HIDS software running on the same machine

I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database ...
5
votes
3answers
1k views

Best practice for creating an initial IPS policy

I see that most IPS available in the market comes with a basic pre-defined policy which administrators can base on when creating their initial IPS policy. However, these policy may be insufficient and ...
4
votes
3answers
461 views

Information gathering before deploying a Network IPS

I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
6
votes
3answers
653 views

How can an IPS be fingerprinted?

I'm not trying to solve a current technical problem but I came across this and have been wondering how it's done. Intrusion Prevention Systems are supposed to let all network traffic pass through and ...
11
votes
3answers
533 views

Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?

This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too. Rich posted these follow-up tweets: And by APT I mean real ...
3
votes
1answer
371 views

Checkpoint NGX IPS & NAT

how does CheckPoint R65/R70 handle IPS violations of outbound traffic from hosts that are NAT'ed? Is it necessary to include the NAT'ed IP in the exceptions list or is it sufficient to include the ...
7
votes
1answer
1k views

Intrusion Prevention Logs

I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the ...
6
votes
1answer
998 views

Tools to identify and report hacking attempts originating inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
9
votes
3answers
617 views

What FOSS software do you like to use to build intrusion detection stacks?

Start-ups and organizations with limited budgets that are security conscious are often encouraged to deploy intrusion detection stacks. Given that prevention will always fail, intrusion detection ...
1
vote
1answer
218 views

What is your experience with AlertLogic?

Do you have any insight, or experience (good or bad) regarding AlertLogic? In what areas can they improve, what areas are they lagging in?
5
votes
2answers
170 views

Managing a team of IDS experts; how would you orgainze your team?

Suppose you are managing a team of Intrusion Detection Experts: ...what are the functional areas of the IDS knowledge space would you group your team into? ...how would you structure your team? ...