what false alarm rate do you tolerate for your current monitoring
system? is 1 false alarm in 4 ok? 1 in 10? 1 in 100?

a related question is: what false alarm rate must anomaly detection
systems achieve to be useful?

i know this is person/site/situation/etc specific, and welcome any
ballp

[ more ]  [ reply ]

Except they didn't standardize the keys....

proto=6 src zone=Trust dst zone=Untrust action=Permit

There is a space before zone that hoses things up.

Dilley, Ron wrote:
> Jas,
>
> This does not look too bad as long as you don?t use regex to parse it.
>
> Key=value all the way . . .
>
> Ron
>
>
>
>

[ more ]  [ reply ]

All,

Ah, long time - no post! :-)

I wanted to turn this into a formal contest but figured I'd poll the
list first: what are the ugliest, most useless application logs that
you've seen? Logs that defy log analysis, that are full of numeric
codes not explained anywhere? Logs that don't say what they

[ more ]  [ reply ]

On Wed, 16 Jan 2008 14:49:30 -0800 (PST), E G <bronc94583 (at) yahoo (dot) com [email concealed]> wrote:
> I've done extensive testing with the Samba and
> Samba-ng versions of implementing WMI, and neither of
> them are correct in their implementation (unless a
> newer version has come out in 07 that I haven't seen).

You can

[ more ]  [ reply ]

I have code that implements WMI in Perl for a variety of functions, but
using WMI to grab Event Logs is ssssslllllloooooowwwww.....

------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Response"
"Windows Forensic Analysis"
"Perl Scripting for Windows Se

[ more ]  [ reply ]