topic Re: Baselining or Soaking a Sensor in Network Security https://community.cisco.com/t5/network-security/baselining-or-soaking-a-sensor/m-p/958085#M79435 <HTML><HEAD></HEAD><BODY><P>We have a modified policy we use to start with but typically two weeks seems to be sufficient. That depends upon the sort of traffic you see, the placement of the sensor, and how busy it is. I could easily see spending an hour a day for several weeks tuning/profiling if this sensor was generating 50k events / day.</P></BODY></HTML> Mon, 14 Jul 2008 14:07:12 GMT attmidsteam 2008-07-14T14:07:12Z Baselining or Soaking a Sensor https://community.cisco.com/t5/network-security/baselining-or-soaking-a-sensor/m-p/958084#M79431 <P>When a bringing up a new sensor in a network typically how long should the sensor be allowed to baseline or soak for before tunning begins? Does cisco recommend a specific time period?</P> Sun, 10 Mar 2019 11:11:47 GMT https://community.cisco.com/t5/network-security/baselining-or-soaking-a-sensor/m-p/958084#M79431 niall-wilkins 2019-03-10T11:11:47Z Re: Baselining or Soaking a Sensor https://community.cisco.com/t5/network-security/baselining-or-soaking-a-sensor/m-p/958085#M79435 <HTML><HEAD></HEAD><BODY><P>We have a modified policy we use to start with but typically two weeks seems to be sufficient. That depends upon the sort of traffic you see, the placement of the sensor, and how busy it is. I could easily see spending an hour a day for several weeks tuning/profiling if this sensor was generating 50k events / day.</P></BODY></HTML> Mon, 14 Jul 2008 14:07:12 GMT https://community.cisco.com/t5/network-security/baselining-or-soaking-a-sensor/m-p/958085#M79435 attmidsteam 2008-07-14T14:07:12Z Re: Baselining or Soaking a Sensor https://community.cisco.com/t5/network-security/baselining-or-soaking-a-sensor/m-p/958086#M79436 <HTML><HEAD></HEAD><BODY><P>You can begin performing event analysis as soon as you plug your sensor into the network. This will allow you eliminate false positives and create filters for events you don't want to see again from a particular host/network. The more you tune your signatures, the higher the quality of events you will get from them.</P><P>The only aspect that might need any â&#128;&#156;soakâ&#128;&#157; time is the dozen or so â&#128;&#156;anomaly engine signaturesâ&#128;&#157; The anomaly engine needs a day to a week to â&#128;&#156;learnâ&#128;&#157; what is normal traffic on your network, but that isn't any reason to wait to begin signature tuning.</P><P></P></BODY></HTML> Mon, 14 Jul 2008 18:36:06 GMT https://community.cisco.com/t5/network-security/baselining-or-soaking-a-sensor/m-p/958086#M79436 rhermes 2008-07-14T18:36:06Z