topic Firesight detection engine in Network Security

Firesight detection engine

filterfilter — Tue, 12 Mar 2019 13:07:27 GMT

Hi,

I have a case that a potential positive injection using API related coding was passing through our IPS, and no intrusion event was seen on Intrusion event. I check the documentation and found out that snort combines signature, protocol and anomaly for inspection methods.

what would be the possible reason that it happened? was the attempt not matching any Snort rules for injection or 3 of the methods it use?

any insight would be very helpful, Thanks!

I would have guessed that it

chris.proudlock — Mon, 12 Sep 2016 15:17:33 GMT

I would have guessed that it passed because no rules specifically looking for your applications API exist.

You could write one of your own?

Hello ,

Jetsy Mathew — Tue, 13 Sep 2016 13:19:05 GMT

Hello ,

Its advisable that customers can create custom snort detection rules.

Here are some helpful links.

http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node27.html

Rate and mark correct the helpful posts

Regards

Jetsy