Tag Info

Hot answers tagged


A tool like HP ArcSight can be customized very deeply, and just writing the right use cases and rules to correlate relevant events and alert on meaningful incidents, is super hard. Many organizations fail miserably implementing ArcSight. Just getting raw logs through connectors to logger and then to ESM, and then writing use cases is a project that ...


An NIDS would not be able to detect a buffer overflow for a couple of reasons. It's impossible to know what the target platform for the payload is; strictly based off of network traffic. Exploits at the network level most likely target some application or daemon on the other side. The buffer overflow is likely targeting a specific vulnerability, and this ...

Only top voted, non community-wiki answers of a minimum length are eligible