Requires Free Membership to View
SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!
Michael S. Mimoso, Editorial DirectorYou should ask them for information contained in the list below. The IDS team may have all of it, or just act as a group that feeds into another team that does the analysis.
- Number of alerts, sorted by severity (high, medium, low) and particular probe (You should have a numerical naming structure for all probes to quickly identify where the data is coming from.)
- Number of high alerts that have been resolved
- List of high alerts that are still pending investigation, including priorities
- List of known false positives
- Planned changes to signature base to deal with false positives and new signature releases
- Overall network diagram showing placement of IDS probes (This changes frequently, so including it in a monthly report helps you understand where you are getting data from.)
Note that "Number" just means a count. "List" indicates that we want a simple description of each issue.
Hope this helps.
For more information on this topic, visit these other SearchSecurity.com resources:
News & Analysis: Software takes holitic approach to detecting security glitches
Infosec Know IT All Trivia: Intrusion detection
Scheier's Security Product Roundup: Vendors struggle to provide common view of security events
This was first published in January 2003