IDS: Re: RE: RE: Tuning false positives - SIM is not the answer

[rassel_k () hotmail securityfocus com, com () securityfocus com]

My point is that if you get many innocent users caught by your IDS (or IPS) it doesn't matter if you correlate or 
present them in graphs or priorities. Mapping (or blocking) good communication as bad will lead to bad outcomes.
If you don't have false alarms then SIM will be great to show you what's what, but in my experience that is not the 
case and you'd be correlating the wrong thing.

Rassel

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------