IDS: RE: IDS Tuning

["Arun Vishwanathan" <arun.vishwanathan () nevisnetworks com>]

"IDS Tuning" could be defined as Customizing an IDS for ones network. 

AFAIK "IDS tuning" would largely imply "IDS Signature Set tuning" which
further means tweaking/modifying the signature set to reduce false
positives and make the IDS more reliable and also faster in some
situations. 

Every network is different in some way or other and hence signatures
that are required for a particular network may not be required for
another network. For example, if your network does not have APACHE based
Web servers then you can disable Apache category in Snort. This kind of
tuning may also give you better speed with the IDS. 

Similarly, an admin would like to disable signatures which are likely to
produce too much of false positives in "his" network. I am not sure if
there is a document on this or not but to tune an IDS you need to have a
good understanding of all App level protocols (SMTP/FTP/Telnet/HTTP etc)
and also have a good understanding of the signature set. 


HTH. 
Regards,
Arun

-----Original Message-----
From: Naveen Sharma [mailto:naveenkat () gmail com] 
Sent: Friday, March 10, 2006 2:19 AM
To: focus-ids () securityfocus com
Subject: IDS Tuning

Hi All,

What exactly is  IDS tuning ? Please provide steps to tune Snort.

Thanks in advance.

Cordial regards

Naveen



------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------