Ask the Expert

IDS data to include in monthly report

I am planning to compile security metics for a monthly report. Included will be statistics from the IDS. My question is: What statistics do I ask the technicians who are monitoring the IDS to provide me?

    Requires Free Membership to View

You should ask them for information contained in the list below. The IDS team may have all of it, or just act as a group that feeds into another team that does the analysis.

  • Number of alerts, sorted by severity (high, medium, low) and particular probe (You should have a numerical naming structure for all probes to quickly identify where the data is coming from.)
  • Number of high alerts that have been resolved
  • List of high alerts that are still pending investigation, including priorities
  • List of known false positives
  • Planned changes to signature base to deal with false positives and new signature releases
  • Overall network diagram showing placement of IDS probes (This changes frequently, so including it in a monthly report helps you understand where you are getting data from.)

Note that "Number" just means a count. "List" indicates that we want a simple description of each issue.

Hope this helps.

For more information on this topic, visit these other resources:
News & Analysis: Software takes holitic approach to detecting security glitches
Infosec Know IT All Trivia: Intrusion detection
Scheier's Security Product Roundup: Vendors struggle to provide common view of security events

This was first published in January 2003

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: