Re: IDS detection approaches

[Gary Halleen <ghalleen () cisco com>]

Anyone with a valid license is able to download the signatures to be placed
on your Cisco sensor.  Once you have placed them on your sensor, you are
free to open/edit/manipulate or add to the signatures at will.

Open signatures does not mean they are "open source" or free.  Without a
Cisco sensor, they won't be much use to you.

If you have a CCO account, you can download the signatures at:
http://www.cisco.com/cgi-bin/tablebuild.pl/ips6-sigup

Gary



On 10/12/07 9:59 PM, "Randal T. Rioux" <randy () procyonlabs com> wrote:

> Gary Halleen wrote:
> <snip>
> > Additionally, all Cisco IPS signatures are open.  You are able to view all
> > or most fields of signatures, create your own, and modify existing
> > signatures.  You do not need to wait for Cisco to release new signatures if
> > you have sufficient IDS/IPS skills to write a new signature.  If you can
> > write a snort rule, you can write a Cisco IPS signature.
>
> Open? Really? Where can I download them?
>
> Thanks,
> Randy


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------