2

Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if this idea makes sense and which sorts of attacks would benefit if handled this way?

  • I don't understand your "obtained from an external system" part of your question. In general, if you want increased IDS/IPS visibility for some impending pen test or attack, you could increase the logging level (stackoverflow.com/questions/7839565/…) – armani Oct 28 '15 at 21:41
  • Do you have any information about the method of attack or targets? In a properly configured IDPS, increasing 'protection' would in some way impact your users. It will also impact your event monitoring team. If you haven't optimized the configuration to your environment, then choosing a more protective default option is likely to provide increased protection but much of it will not be useful in your environment. IDPS configuration is about balancing security, work load, and connectivity/usability concerns. – Jeff K Feb 24 '17 at 18:54
0

Most IDS/IPS allow you to write your own rules , for example snort rules. So if you have indicators from a 3rd party then adding them in as custom rules is one option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.