Re: IDS detection approaches

Gary Halleen wrote:
<snip>
> 
> Additionally, all Cisco IPS signatures are open.  You
are able to view all
> or most fields of signatures, create your own, and
modify existing
> signatures.  You do not need to wait for Cisco to
release new signatures if
> you have sufficient IDS/IPS skills to write a new
signature.  If you can
> write a snort rule, you can write a Cisco IPS
signature.

Open? Really? Where can I download them?

Thanks,
Randy

------------------------------------------------------------
------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecuri
ty.com/index.php5?module=Form&action=impact&campaign
=intro_sfw 
to learn more.
------------------------------------------------------------
------------

Anyone with a valid license is able to download the
signatures to be placed
on your Cisco sensor.  Once you have placed them on your
sensor, you are
free to open/edit/manipulate or add to the signatures at
will.

Open signatures does not mean they are "open
source" or free.  Without a
Cisco sensor, they won't be much use to you.

If you have a CCO account, you can download the signatures
at:
http://www.cisco.com/cgi-bin/tablebuild.pl/ips6-sigup

Gary



On 10/12/07 9:59 PM, "Randal T. Rioux"
<randyprocyonlabs.com> wrote:

> Gary Halleen wrote:
> <snip>
>> 
>> Additionally, all Cisco IPS signatures are open. 
You are able to view all
>> or most fields of signatures, create your own, and
modify existing
>> signatures.  You do not need to wait for Cisco to
release new signatures if
>> you have sufficient IDS/IPS skills to write a new
signature.  If you can
>> write a snort rule, you can write a Cisco IPS
signature.
> 
> Open? Really? Where can I download them?
> 
> Thanks,
> Randy


------------------------------------------------------------
------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecuri
ty.com/index.php5?module=Form&action=impact&campaign
=intro_sfw 
to learn more.
------------------------------------------------------------
------------