4 ms·
Noisetotal
- ycluo 4y agoVirusTotal consolidates threat intelligence on files, IPs, URLs, etc. Has anyone heard of NoiseTotal for consolidating security noises? https://hubs.li/Q01dXCVl0 https://hubs.li/Q01dXCVl0 - Those weird system behaviors, bugs, configuration errors, and inaccurate scanners that generate something look suspicious/risky but are not malicious. Get community support or feedbacks on false positive security alerts as we all experience it and hate it!
- NonNefarious 4y agoUseless title. Re-do.
- _8j50 4y agoIt's a game of cat and mouse. As someone that works on detection content, I would consider patterns I consider false postivie a secret. Because potential attackers can otherwise craft their payloads and techniques to go undetected. For example, if you consider a nikto or openvas user-agent a false positive when detecting for specific traffic anomalies all one has to do is use those user-agents and evade detection. That said, I do appreciate and use things like MISP warning-lists with care.
- ycluo 4y agoregarding something like virus total I think advanced hackers do also verify there first before attack to evade. I feel NoiseTotal is useful. But probably it should be gated to people within a small community. (for example only share between universities or healthcare) Making it completely public is risky. What do you think?