Re: Updating Enterasys Dragon NIDS signature...

From: Jordan Wiens (numatrix_at_ufl.edu)
Date: 08/09/05

  • Next message: Brian Azzopardi: "A possible HIPS? Was: Looking for HIDS-only products for XP/2000Pro" 
    Date: Tue, 9 Aug 2005 08:43:23 -0400 (EDT)
To: Jean-Pierre Denis <jp@webglobe.ca>

    That's odd, they're usually pretty helpful in my experience. Even better
    is the mailing list, though. That's often the best place to ask dragon
    related questions (dragonidsuser@enterasys.com).

    What version of NIDS are you running? The signatures are all available
    for manual download directly from the enterasys website:
    https://dragon.enterasys.com/ (the website also has archives of the
    mailing list, so does marc.theaimsgroup.com)

    Depending on your architecture, you can either manually push out the
    signatures using scp and ssh to your sensors from another machine on the
    closed network, or import the new signatures into your dragon policy
    manager (DPM, or whatever it's called with whatever version you're
    running) and have it push them out. 

    -- 
Jordan Wiens, CISSP
UF Network Security Engineer
(352)392-2061
On Sat, 6 Aug 2005, Jean-Pierre Denis wrote:
> Hi everyone,
>
>
>  I have a bunch of Dragon NIDS to update but they don't have internet
>  connection to do so. Since it's a closed network the update screw up
>  everytime because enterasys designed it to access their site.
>
>  Does someone have this type of experience with Dragon appliance?
>
>  Enterasys is not very helpful and I don't know where to start.
>
>
> Merci,
> Jean-Pierre Denis
> (LPIC1 - LPIC2)
> WebGlobe Solutions TI
> email: jp@webglobe.ca
> tel.: (819) 246-0WWW (0999)
> www:   http://www.webglobe.ca
>
>
> -----------------------------------------
> WebMail Powered by WebGlobe.
> http://www.webglobe.ca
>
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
> ------------------------------------------------------------------------
>
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------
  • Next message: Brian Azzopardi: "A possible HIPS? Was: Looking for HIDS-only products for XP/2000Pro"

    Relevant Pages

    • RE: dragon and snort logs
      ... > It is a fairly common occurrence for Enterasys customers to use snort. ... the time to write custom signatures for their existing IDS, ... with them to import those to Dragon, since Dragon is one of the few ... they are freely available on our support site. ...
      (Focus-IDS)
    • RE: Where is Ron Gula? (was "Changes in IDS Companies?")
      ... This answer is coming from someone on the Dragon team (who already gets enough spam in his ... Enterasys account - so I apologize in advance for using the @yahoo.com addy. ... If you read the "Dragon Newsletter" that I put out on the Dragon IDS users list, ... Subject: Where is Ron Gula? ...
      (Focus-IDS)
    • RE: IDS Opinions
      ... Our compagny is using Dragon (Enterasys) appliances for our clients ... Subject: IDS Opinions ... instead as it is open source, and also sourcefire is built upon snort. ...
      (Focus-IDS)
    • Re: Where is Ron Gula? (was "Changes in IDS Companies?")
      ... I left Enterasys back in September and founded a new company ... I still get a lot of people who want to re-sell Dragon ... >year and Ron Gula has left Enterasys Networks, ... >Response from Randy Taylor, Enterasys Networks: ...
      (Focus-IDS)
    • Dragon IDS suffering
      ... Dragon's engineers have all bolted to Snort and other IDS companies. ... Do you think Dragon IDS will be spun out of Enterasys or shut-down? ...
      (comp.os.linux.security)