I'm running a small army of IPS sensors in our network, and since upgrading the sensors and MARS today, I've seen huge numbers of signature 5894, the Storm Worm signature. Now, the signature specifies that it can fire for any nginx server, and I speculate that that's what is happening (it's fired for yahoo sites, etc).
So, is there any way I can more finely tune this, or is there other traffic that would be present in the case that a workstation was truly infected? Our users have shown a concern about this Storm Worm and I need to be prepared.
Thanks.