analysing nids alerts

[nataraj_v]

Dear All,

I have few nids 4235, i find enough documentation about updating signatures and installation of nids. but for analysing only we had nsdb.

can any body guide me, wht are the necessary steps need to analyse these alerts. how to decide whether its a false positive or negative or attack going on. im confused to take a decision on a alert.any help frns

Thanks in advance

Nataraj

[nhoover]

Nataraj,

to start learning the techniques of analysis I would suggest the book "Intrusion Detection" from New Riders Press. This book is written by one of the leading analysts in the field, and a member of the SANS organization. If your really in a hurry there is SANS boot camps specializing in Intrusion Analysis which are great, but you should have background knowledge of TCP/IP to be prepared.