Which preprocessor plays a role in detecting the reconnaissance phase of an attack?
A Snort sensor is generating many false-positive sfPortscan alerts, in which busy, trusted hosts are flagged as the source of port sweep events. Which tuning strategy can mitigate this problem?
Currently there are no comments in this discussion, be the first to comment!