Average Parameter Settings

[rpmanning]

What engine parameters would be acceptable to tune out false positives. I do understand that this is network specific, but was looking for other's averages.

SERVICE.SMB (6255)? I'm thinking HitCount= ~25

FLOOD.NET (UDP)? I'm thinking Rate=4900

FLOOD.NET (TCP)? Maybe Rate=400

[jsivulka]

Have a look at the document 'SAFE: A Security Blueprint for Enterprise Networks'. It will provide a few pointers that you will find helpful.

http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/ns128/networking_solutions_white_paper09186a008009c8b6.shtml

[randy.manning]

Great idea. Thanks