TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
>Received: from brainwash.networkice.com ([10.10.0.68])by
> >frodo.intra.netice.com (8.8.7/8.8.7) with ESMTP id KAA09803;Tue, 19
Arggh.. Another "security" company unable to not advertise their
internal IP address scheme.
No offense 'cuz I'm sure you don't run the mail relays, but it's
"best practice 101" to not advertise your internal IP scheme. And
you would think a company dealing in security software would know
better.
>Arggh..
>
>OK..
>
>you can send enhancement requests to [EMAIL PROTECTED]
Yes, yes you can. We've had VP's of development across the table
from us before when we were asked to participate on their customer
advisory board. Again, this was back in the 2.0 days. We've requested
the below enhancements for years now.
>couple of hints, I suggest contacting their professional services
Now here I can speak from months of frustration. Their pro serv
group used to be horrible. We had "pro serv manager" after "pro
serv manager" in our environment for months on end. Granted, they
spent most of their time reading the RS documentation and that cut
into a lot of their time they could have been working on our issues.
But again, that was at least a year ago, things might've changed.
>department or seek some 3rd party high end consulting service company
> >specializing in IDS..
This actually did do us some good, as far as policy tuning went.
However, it was even the opinion of the 3rd party that RS really
very tunable when it comes to filtering false positives.
Sorry for the tremendously bad attitude, but I've had a lot of
really bad experiences with not only RS, but also ISS's pro serv
group. Has anyone had any good experiences with them?
>At 04:12 PM 9/19/00 +0000, Chris St. Clair wrote:
>>
>>>Signatures.pdf, but others (eg. the TFN2000 one) don't. If it's not
>>>documented, how do you know when it's real, and when it's a false >alarm?
>>
>>Well, you don't. You're basically left to tuning the sigs as best
>>you can to decrease the number of false positives.
>>
>>I've used RS since 2.0 and this has always been a sticking point for
>>me with RS. Not all of the sigs are adjustable, and adjusting the
>>wrong way can lead to 1) too many false positives to track down if you
>>tune it too "rich" or, B) not picking up actual attacks because you
>>tuned it to "lean".
>>
>>I understand that the sig definitions are proprietary and publishing
>>the details would allow others to copy them and create an IDS based
>>on their work. However, that excuse doesn't help me very much at all.
>>
>>If you're looking for a fully customizeable IDS that you can have
>>full access to sig decodes look into NFR or SHADOW. Granted, you may
>>have to do a bit of sig writing yourself, but at least with those you
>>actually have that option.
>>
>>-chris
>>_________________________________________________________________________
>>Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
>>
>>Share information about yourself, create your own public profile at
>>http://profiles.msn.com.
>>
>>
>
_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.
Share information about yourself, create your own public profile at
http://profiles.msn.com.
