This document is not a guide about how to fine-tune a sensor to nail out false positives and such, it just tries to summarize different approaches you can take after deciding that you in fact want to stop an alert from firing. Also, while Snort supports different kind of thresholding, this document is only about how to shut down specific alerts completely. The content reflects my personal opinions, which may not be valid in your environment, or even correct.

Category: Recommended Snort Sites

Added on: Jul 18, 2008 | Hits: 1252