A new IDS device is generating a very large number of irrelevant events. Which of the following would BEST remedy this problem?

The correct answer is B. Adjust IDS filters to decrease the number of false positives. Irrelevant events generated by an IDS are false positives - legitimate traffic or activity incorrectly flagged as malicious. The direct remedy is to tune the IDS filters to reduce these false positives, which is exactly what Option B states. This involves refining signatures…

Technical Integration of Enterprise Components

Question

Options

AChange the IDS to use a heuristic anomaly filter.
BAdjust IDS filters to decrease the number of false positives.
CChange the IDS filter to data mine the false positives for statistical trending data.
DAdjust IDS filters to increase the number of false negatives.

How the community answered

(39 responses)

A
3% (1)
B
95% (37)
C
3% (1)

Explanation

Irrelevant events generated by an IDS are false positives - legitimate traffic or activity incorrectly flagged as malicious. The direct remedy is to tune the IDS filters to reduce these false positives, which is exactly what Option B states. This involves refining signatures, adjusting thresholds, and whitelisting known-good traffic. Option A (switching to heuristic/anomaly mode) changes the detection methodology but does not necessarily reduce false positives - anomaly-based detection can actually generate more. Option C wastes resources by mining irrelevant noise for trends instead of eliminating it. Option D is dangerous: increasing false negatives means the IDS will miss actual attacks, trading noise for blindness.

Topics

#IDS tuning#false positives#intrusion detection#anomaly detection

Community Discussion

No community discussion yet for this question.

Full CAS-001 Practice