[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

SV: [ISSForum] Signature tuning



Have a look at the following knowledgebase article:

https://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_sid=2myMzxth&p_lva=2190&p_faqid=2190&p_created=1068160356&p_sp=cF9zcmNoPTEmcF9ncmlkc29ydD0mcF9yb3dfY250PTEmcF9zZWFyY2hfdGV4dD0yMTkwJnBfc2VhcmNoX3R5cGU9MyZwX3Byb2RfbHZsMT1_YW55fiZwX3Byb2RfbHZsMj1_YW55fiZwX2NhdF9sdmwxPX5hbnl_JnBfc29ydF9ieT1kZmx0JnBfcGFnZT0x&p_li=

Attached in this article is a file called pam.zip. This file contains PAM (Protocol Analysis Module) tuning parameters.

/andreas

-----Ursprungligt meddelande-----
Från: issforum-bounces@xxxxxxxxxxxxxxxx För Soda, Marc
Skickat: den 20 december 2004 19:24
Till: issforum@xxxxxxxxxxxxxxxx
Ämne: [ISSForum] Signature tuning

Hello all,

Is anyone aware of documentation or resources for tuning specific IDS
signatures?  I'm trying to eliminate a high number of false positives.

Thanks,
-- 
Marc Soda, CISSP
Information Security Engineer
NCO Group
215.441.2189


_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.



_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.