[Dshield] Submitting logs from two devices
Anthony_Rodgers at dnv.org
Thu Feb 8 23:44:29 GMT 2007
Is it acceptable to submit logs from two sources (Internet facing
firewall and a snort IDS that resides inside the firewall)? My thinking
is that our IDS picks up on badness that gets through our firewall's
open ports and therefore might provide some additional useful data.
If so, is it sufficient to have two instances of the Universal Client
running on a machine, using the same DShield ID?
Business Systems Analyst
District of North Vancouver
RSS Feed: http://www.dnv.org/rss.asp
More information about the list