Tag Info

New answers tagged

0

I do not really like the idea of running multiple instances of snort. Note that as far as I remember snort is not a multi-threading detection engine. I think this solution will create a performance issue assume you have n numbers of rules set. Is this mean you will run n number of snort instances? So, how can you do it? you need to use a log parser. So ...


4

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


0

alerting depends on the rule(sets) loaded; VRT is different from ET and are shipping different rules; they share a common set of open vrt-rules though so when one ruleset loaded is alerting, and the other not, your should adjust your ruleset. for further questions i'd like to direct you to the snort-mailing-list, becuase this is a ...


1

If it's that much of a secure environment you should never disable your IDS. Besides, if your IDS picks up your vulnerability scanner - Thats good as you know your IDS is working and not been tampared with. I'd recommend something like: 1. Add your IP (which you'll be doing your scan from) to a whitelist so you're excluded from your rules then do your ...


1

On a) most IDS' allow the option of blocking addresses from generating alerts which answers your b). I believe the approach you are taking is a decent approach however, I need chime in that it is BEST to perform dual scanning. From the OUTSIDE of your perimeter, and from the inside. The reasoning is simple, external scanning usually finds nothing more than ...


1

You've got a number of options. The first and most common is to instruct the IDS to ignore attacks originating at the vulnerability scanner, and to configure the vulnerability scanner to correspond to the IDS. The second solution, which requires a lot more work, but has a lot more value is to take this as an opportunity to validate the behavior of both ...



Top 50 recent answers are included