IDS data to include in monthly report

IDS data to include in monthly report

I am planning to compile security metics for a monthly report. Included will be statistics from the IDS. My question is: What statistics do I ask the technicians who are monitoring the IDS to provide me?

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

You should ask them for information contained in the list below. The IDS team may have all of it, or just act as a group that feeds into another team that does the analysis.

  • Number of alerts, sorted by severity (high, medium, low) and particular probe (You should have a numerical naming structure for all probes to quickly identify where the data is coming from.)
  • Number of high alerts that have been resolved
  • List of high alerts that are still pending investigation, including priorities
  • List of known false positives
  • Planned changes to signature base to deal with false positives and new signature releases
  • Overall network diagram showing placement of IDS probes (This changes frequently, so including it in a monthly report helps you understand where you are getting data from.)

Note that "Number" just means a count. "List" indicates that we want a simple description of each issue.

Hope this helps.


For more information on this topic, visit these other SearchSecurity.com resources:
News & Analysis: Software takes holitic approach to detecting security glitches
Infosec Know IT All Trivia: Intrusion detection
Scheier's Security Product Roundup: Vendors struggle to provide common view of security events


This was first published in January 2003