3 ms·
I’m yet to see a signature matching system with defaults which are actually good. Don’t get me wrong, the ability to add regex filters are infinitely valuable f
by hsbauauvhabzb 4y ago
I’m yet to see a signature matching system with defaults which are actually good. Don’t get me wrong, the ability to add regex filters are infinitely valuable for custom or emergency mitigations, but I think largely current systems blocking heuristics which look like attacks aren’t solving much.
That being said, I’m interested to see anomaly detection engines that learn data patterns and flag potentially malicious traffic.
- viraptor 4y agoI don't believe reasonable defaults are possible for that use case. I mean, some anomalies are sure interesting. But I don't care about people trying to exploit MS exchange on my Linux boxes... Everyone runs something different, so unless a lot of profiles are provided that you can turn on/off, what would a reasonable default even be?
- hsbauauvhabzb 4y agoThat’s my point. Though, maybe there is something to be said for blocking things like OWA vulnerabilities as compared to generic xss/sqli detection rules.