Re: IDS detection approaches

Anyone with a valid license is able to download the signatures to be placed
on your Cisco sensor. Once you have placed them on your sensor, you are
free to open/edit/manipulate or add to the signatures at will.

Open signatures does not mean they are "open source" or free. Without a
Cisco sensor, they won't be much use to you.

If you have a CCO account, you can download the signatures at:
http://www.cisco.com/cgi-bin/tablebuild.pl/ips6-sigup

Gary



On 10/12/07 9:59 PM, "Randal T. Rioux" <randy@xxxxxxxxxxxxxxx> wrote:

Gary Halleen wrote:
<snip>

Additionally, all Cisco IPS signatures are open. You are able to view all
or most fields of signatures, create your own, and modify existing
signatures. You do not need to wait for Cisco to release new signatures if
you have sufficient IDS/IPS skills to write a new signature. If you can
write a snort rule, you can write a Cisco IPS signature.

Open? Really? Where can I download them?

Thanks,
Randy


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------

Relevant Pages
Quantcast