CAS-002 · Question #595
A new IDS device is generating a very large number of irrelevant events. Which of the following would BEST remedy this problem?
The correct answer is B. Adjust IDS filters to decrease the number of false positives. Too many irrelevant IDS events indicate excessive false positives, which are best resolved by tuning the IDS filters to reduce them.
Question
A new IDS device is generating a very large number of irrelevant events. Which of the following would BEST remedy this problem?
Options
- AChange the IDS to use a heuristic anomaly filter.
- BAdjust IDS filters to decrease the number of false positives.
- CChange the IDS filter to data mine the false positives for statistical trending data.
- DAdjust IDS filters to increase the number of false negatives.
How the community answered
(32 responses)- B91% (29)
- C3% (1)
- D6% (2)
Why each option
Too many irrelevant IDS events indicate excessive false positives, which are best resolved by tuning the IDS filters to reduce them.
Switching to heuristic anomaly detection changes the detection methodology entirely rather than tuning out the specific irrelevant alerts already being generated.
False positives are alerts generated on benign traffic that do not represent actual threats, and they are the direct cause of 'irrelevant events.' Adjusting IDS filters - by refining signatures, tuning thresholds, or whitelisting known-good traffic - reduces these spurious alerts without degrading detection of genuine threats.
Data mining false positives for statistical trends analyzes the problem after the fact rather than reducing the volume of irrelevant alerts being generated.
Increasing false negatives causes the IDS to miss real attacks, which degrades security posture rather than improving alert relevance.
Concept tested: IDS tuning to reduce false positive alerts
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf
Topics
Community Discussion
No community discussion yet for this question.