Cisco CyberOps Professional 350-201 Question # 3 Topic 1 Discussion
350-201 Exam Topic 1 Question 3 Discussion:
Question #: 3
Topic #: 1
Refer to the exhibit.
IDS is producing an increased amount of false positive events about brute force attempts on the organization’s mail server. How should the Snort rule be modified to improve performance?
To reduce the number of false positive events about brute force attempts on the organization’s mail server, the Snort rule should be modified to tune the count and seconds threshold. This adjustment will help in defining what constitutes normal versus suspicious activity patterns more accurately. By setting a higher count or longer time threshold, the rule will be less likely to trigger on normal login attempts, thus reducing false positives.
References:
Snort User Manual: Provides guidance on configuring and tuning Snort rules.
Best Practices for IDS Configuration: Offers strategies for reducing false positives in intrusion detection systems.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit