2

Is anyone familiar with a tool that can audit the configuration of an intrusion detection/ intrusion prevention tool? I'm looking for a tool that can check for best practices, and non standard configurations. I have googled just about everything and I only come up with white papers.

closed as off-topic by Steffen Ullrich, Anders, HashHazard, techraf, Xander Oct 25 '16 at 0:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    There is no standard config file or format for IDS/IPS. So, there can be no tool. – schroeder Oct 24 '16 at 17:10
  • 1
    Instead of auditing the configuration, people typically just run penetration test/vulnerability scans and see if expected results show up in the IDS. – Herringbone Cat Oct 24 '16 at 17:35
1

Does it work? IPS and IDS are very specific configurations. Plus, the general behavior of each provider is different. Some fail-open, some fail-closed and some just fail.

The best way to audit is to:

  1. Identify what assets/resources are being protected by the ((IP|ID)S).
  2. Document the current configurations. (You need to know exactly what polices are being applied to each protected asset/resource). Literally, map asset/resources to policy.
  3. Determine what tools and test need to be run against the assets/resources.
  4. Run the sets and interpret the results.
  5. Tune the device as needed.
  6. Realize that you will get false(neg|positive)results.
  7. Realize that the application is the right place to fix vulnerabilities.
  8. Repeat 3-7 until confidence rating is high or completely shot.
  9. If confidence rating is completely shot or you don't want to have all this weight on your shoulders and massive ramp up, get experts on the problem.
0

Whoever is the provider of the IDS/IPS system should provide documented guidance on how to install, configure and maintain the system to maximise the security it provides. You should then be able to audit the current configuration and management process against that documentation and for maintenance verify the system version and signature files in use are supported and current.

If the above is in place, you should be able to detect and/or prevent intrusions and malicious traffic. Then you can tune the system to filter out the noise and configure priorities for alerts and decide on your response, investigation and escalation processes.

Not the answer you're looking for? Browse other questions tagged or ask your own question.