Newbie question: autoblocking with IDS/IPS

From: Daniel (somebody1_at_gmx.net)
Date: 12/10/04

  • Next message: Jeff Dell: "Honeynet Security Console 1.2 Released" 
    Date: 10 Dec 2004 15:47:36 -0000
To: focus-ids@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Hi,

    I'm thinking of buying one of that new CISCO IDS boxes which can be placed inline in the future.

    Is anybody of you using the automatic shunning (I guess it's called so) feature of the CISCO IDS?
    Does this make sense? (Which signatures should be autoblocked?)

    Or are you just monitoring and then blocking manually?

    Any hint would be greatly appreciated!
    -Daniel

    --------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from
    CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    --------------------------------------------------------------------------

  • Next message: Jeff Dell: "Honeynet Security Console 1.2 Released"