Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if this idea makes sense and which sorts of attacks would benefit if handled this way?
2
-
I don't understand your "obtained from an external system" part of your question. In general, if you want increased IDS/IPS visibility for some impending pen test or attack, you could increase the logging level (stackoverflow.com/questions/7839565/…)– armaniCommented Oct 28, 2015 at 21:41
-
Do you have any information about the method of attack or targets? In a properly configured IDPS, increasing 'protection' would in some way impact your users. It will also impact your event monitoring team. If you haven't optimized the configuration to your environment, then choosing a more protective default option is likely to provide increased protection but much of it will not be useful in your environment. IDPS configuration is about balancing security, work load, and connectivity/usability concerns.– Jeff KCommented Feb 24, 2017 at 18:54
Add a comment
|
1 Answer
Most IDS/IPS allow you to write your own rules , for example snort rules. So if you have indicators from a 3rd party then adding them in as custom rules is one option.
answered Jun 6, 2019 at 1:18
