[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ISSForum] Realsecure Server Sensor - Network Filtering



I think it is not so.
You can filter events by using the advanced parameter trust.pair or
trust.issue as it in BlackICE by editing config files on sensor.
The only diff between filtering in NS rather than in SS is that it is not
defined in the gui of the policy editor.

More info is available on
http://documents.iss.net/literature/BlackICE/BI-AAG_70.pdf  Check out
pages 24 and 25.
http://documents.iss.net/literature/RealSecure/RS_SvrSensor_Adv_Tuning_R
eference_Windows.pdf
http://documents.iss.net/literature/RealSecure/nsAdv_Tuning_Reference.pdf
---
Best regards, Sergey V. Soldatov.
Information security department.


                                                                                                                    
              dmsimpson@xxxxxxx                                                                                     
              Sent by:                         To:       "Michael Nurre" <mnurre@xxxxxxxxxxxxxxxx>                  
              issforum-bounces@xxxxxxx         cc:       issforum-bounces@xxxxxxx, issforum@xxxxxxx                 
                                               Subject:  Re: [ISSForum] Realsecure Server Sensor - Network          
                                                Filtering                                                           
              08.10.2004 15:49                                                                                      
                                                                                                                    
                                                                                                                    




No you cannot.  I have actually been requesting this from ISS for a little
over three years.

Thanks,

David M Simpson
Risk Management Enterprise Security
Intrusion Detection Lead
American Electric Power
614.716.3139
dmsimpson@xxxxxxx




"Michael Nurre" <mnurre@xxxxxxxxxxxxxxxx>
Sent by: issforum-bounces@xxxxxxx
10/07/2004 03:48 PM


        To:     issforum@xxxxxxx
        cc:
        Subject:        [ISSForum] Realsecure Server Sensor - Network
Filtering


Does anyone know if it is possible to filter out specific IP addresses for

different signatures on the Server Sensor 7.0 like you can with the
Network Sensor? I would think it possible by editing some of the ini files

under the BlackIce directory on the server sensor installation.
_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.


_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.





_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.