The sky is falling! The sky is falling! Okay, well the sky isn't really falling, but isn't that they way that we all felt the first time we installed a NIDS and turned it on? We watched the alerts fly by the screen quicker than we could determine what they were. If we were lucky we could just make out what colors the alerts were. Unfortunately that stigma has stuck with the intrusion detection industry. Some people who have NIDS installed have just ignored their screens and been happy with telling the auditors: "Why of course we have intrusion detection. We use -insert brand here-"

The intrusion detection industry has matured over the last few years and most IDS vendors have tried to address the issue of false positives. Between the vendors creating more intelligent NIDS, IDS analysts learning more about how NIDS work and IDS analysts tuning their NIDS, the amount of alerts that are generated are getting to a point where they no longer overwhelm the analyst that is monitoring the events. Yet one of the questions that still looms is "How do you classify and/or group your alerts?"

When signatures are created they are assigned a default alert level based on the severity of the exploit. If you have all HTTP signatures turned on even though you only run Apache should all those Code Red alerts be classified as a high? What if you run an all IIS shop and all your servers are patched, does Code Red still rate a high in your environment?

[ Read more ]

Related items

• Review: Intrusion Detection with SNORT: Advanced IDS Techniques Using SNORT, Apache, MySQL, PHP, and ACID (19 June 2003)
• Article: Intrusion detection (11 June 2003)
• Review: Cisco Secure Intrusion Detection System (27 February 2003)
• Article: Interview with Judy Novak, co-author of "Network Intrusion Detection 3/e" (20 February 2003)
• Review: Network Intrusion Detection 3/e (24 January 2003)
• Article: Layer 2 Analysis of WLAN Discovery Applications for Intrusion Detection (12 November 2002)
• Article: Monitored Intrusion Detection Systems (1 September 2002)
• Article: Structural versus Operational Intrusion Detection (8 April 2002)
• Article: Interpreting Network Traffic: A Network Intrusion Detector's Look At Suspicious Events (4 April 2002)
• Article: Network Intrusion Detection of Third Party Effects (4 April 2002)