IDS Correlation of VA Data and IDS Alerts

by Neil Desai Sept. 1, 2017 via Symantec

The sky is falling! The sky is falling! Okay, well the sky isn't really falling, but isn't that they way that we all felt the first time we installed a NIDS and turned it on? We watched the alerts fly by the screen quicker than we could determine what they were. If we were lucky we could just make out what colors the alerts were. Unfortunately that stigma has stuck with the intrusion detection industry. Some people who have NIDS installed have just ignored their screens and been happy with telling the auditors: Why of course we have intrusion detection. We use insert brand here The intrusion detection industry has matured over the last few years and most IDS vendors have tried to address the issue of false positives. Between the vendors creating more intelligent NIDS, IDS analysts learning more about how NIDS work and IDS analysts tuning their NIDS, the amount of alerts that are generated are getting to a point where they no longer overwhelm the analyst that is monitoring the events

https://www.symantec.com/connect/articles/ids-correlation-va-data-and-ids-alerts

Avatar
2flash 2 weeks, 4 days ago

Hard to understand. Not in matters of technical terms but also because it got a bit outdated.

Reply