IDS: Re: Question on resources needed to manage IDSes

["Anton A. Chuvakin" <anton () chuvakin org>]

> > > 1-5 IDS sensors - 1 Analyst
> > > 5-15 IDS sensors -2 Analysts
> being.  It would be generous to assume a human could qualify a
> reasonably complex alert in 30 seconds.  After that, it's simply a
The above also implies a certain usage scenario. One "complex alert in 30
seconds" implies that the analyst just sits there and stares at the
console where alerts pop up - which might be neither the most common nor
the most effective way. The tools available to analysts would also matter,
namely, how much time it will take to collect the context info and to make
a decision.

I suspect the specific IDS usage details will heavilly affect the "analyst
to sensor" ratios.

-- 
  Anton A. Chuvakin, Ph.D., GCI*
     http://www.chuvakin.org
   http://www.info-secure.org


---------------------------------------------------------------------------
---------------------------------------------------------------------------