Collaborate Disseminate
I’ve set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off:
GPL SHELLCODE x86 inc ebx NOOP
The payload is as follows:
….WANG2..JFIF`… Continue reading Snort false positive?
I’m using Snort in a lab environmnet with artificially generated traffic.
I’m looking to build a confusion matrix from known generated attacks.
True Positives and False Positives are easy to parse out of the alerts file, but I’m looking … Continue reading Logging True/False Negatives on Snort