简介：Technical discussion about Intrusion Detection Systems. You can also read the archives of a previous IDS list

原站：http://seclists.org/#focus-ids

“IDS Focus”的内容更新

累计：574 篇（自 2007-11-01 起）

更新：约3篇/周，最后更新609 天前

IDS Focus

CFP: Deadline Extended: SLAML'10

posted by mohror, kathryn on jun 18 workshop on managing systems via log analysis and machine learning techniques (slaml '10) ============================================= october 2-3, 2010 vancouver, bc, canada (at osdi) http://www.usenix.org/events/slaml10/cfp/ ============================================= ********...... (315 天前)

http://inezha.com/w/7sax9fwc

IDS Focus

Announcement: xtractr updates

posted by pcapr on jun 08just a quick note to let you know that the lite version of xtractr cannow index up to 10 million packets or 1gbyte of pcaps. this makes iteasy to grab large packet traces from a production network and performtroubleshooting and forensics with just a few clicks. we have alsoupdated the live demo of xtractr to use the pcap from... (315 天前)

http://inezha.com/w/s1cuofwl

IDS Focus

Performance measurement tool for IDS/IPS

posted by wittybugz on jun 01hi all,is any tool available in market (free or paid) for measuring performance of host based ids/ips devices? i want to measure performance for protocols like http,ftp,smb/rpc,dns etc.thanks,prateek-----------------------------------------------------------------securing your online data transfer with ssl.a guide to... (315 天前)

http://inezha.com/w/we3nxfw8

IDS Focus

Re: RE: Re: OSSEC and Windows messages

posted by evilwon12 on may 17actually got this working. i am still not 100% sure why it was not working earlier.what i had to do was include the full path, out to the directory i want to exclude, in my match.as i said, it was c:\windows/system32/dir1/dir2/dir3/.../dirx/file.outi was trying to match only on "dirm" and that was constantly failing. by... (315 天前)

http://inezha.com/w/lha3gbwh

IDS Focus

RE: Re: OSSEC and Windows messages

posted by josh little on may 11can you post an example of a rule you are writing? one thing i have found isthat, especially on windows systems messages, i have to explicitly markwhitespace as \s+ instead of just leaving it as is. though, to be fair, thisis typically when monitoring messages received through snare/syslog and notthe ossec agent. also, ... (315 天前)

http://inezha.com/w/kbclebw9

IDS Focus

Re: Re: OSSEC and Windows messages

posted by evilwon12 on may 10sorry if i was not clear in my original post. when i said i have not been able to filter on anything in the message string, i thought that implied that i have already done a custom rule in the local rules file. sorry if that was not clear, but it is not working.-------------------------------------------------------------... (315 天前)

http://inezha.com/w/dq34qbwu

IDS Focus

Re: OSSEC and Windows messages

posted by sohil_garg on may 07you can write a custom rule in local_rules.xml file and filter accordingly.-----------------------------------------------------------------securing your online data transfer with ssl.a guide to understanding ssl certificates, how they operate and their application. by making use of an ssl certificate on your web server... (315 天前)

http://inezha.com/w/i0az9bws

订阅者 ( 1 )

相关订阅源