Firesight detection engine

[filterfilter]

Hi,

I have a case that a potential positive injection using API related coding was passing through our IPS, and no intrusion event was seen on Intrusion event. I check the documentation and found out that snort combines signature, protocol and anomaly for inspection methods.

what would be the possible reason that it happened? was the attempt not matching any Snort rules for injection or 3 of the methods it use? 

any insight would be very helpful, Thanks!

[chris.proudlock]

I would have guessed that it passed because no rules specifically looking for your applications API exist.

You could write one of your own?

[Jetsy Mathew]

Hello ,

Its advisable that customers can create custom snort detection rules.

Here are some helpful links.

http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node27.html

Rate and mark correct the helpful posts

Regards

Jetsy