[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ISSForum] Signature tuning



Yes, ISS has document called PAM.chm that can be found in KB #2190.

Hope that it's what you need, but remmember, that listed configured params
are not all!
---
Best regards, Sergey V. Soldatov.
Information security department.


                                                                                                                    
              "Soda, Marc"                                                                                          
              <marc.soda@xxxxxxxxxxxx>         To:       "'issforum@xxxxxxx'" <issforum@xxxxxxx>                    
              Sent by:                         cc:                                                                  
              issforum-bounces@xxxxxxx         Subject:  [ISSForum] Signature tuning                                
                                                                                                                    
                                                                                                                    
              20.12.2004 21:23                                                                                      
                                                                                                                    
                                                                                                                    




Hello all,

Is anyone aware of documentation or resources for tuning specific IDS
signatures?  I'm trying to eliminate a high number of false positives.

Thanks,
--
Marc Soda, CISSP
Information Security Engineer
NCO Group
215.441.2189


_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.





_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.