How do you use IDS/9000?

[Dave van Nierop]

Hello everybody,

First, my apologies since I realise that this is not a FAQ but a forum. Anyway, I am considering implementing an IDS/9000 and IPFilter, bastille configuration on our HP-UX 11.i servers but really wanted to know if there are any likes / dislikes to IDS/9000 itself ie. is it worth the effort and how does it perform as a host intrusion detection system.

I am sure there are some caveats that you won't find in reference materials anywhere, but it is my belief that you will come across likes/dislikes when you implement a product on different systems and different configurations. My application is limited to 2 servers with exactly the same configurations.

Your insight and/or comments much appreciated in advance.

Thanks a ton - Dave

[Steven E. Protter · Accepted solution]

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5187-0701/5187-0701_top.html&con=/hpux/onlinedocs/5187-0701/00/00/83-con.html&toc=/hpux/onlinedocs/5187-0701/00/00/83-toc.html&searchterms=IDS/9000&queryid=20030716-075619

I love the product. Its got a GUI front end, is realatively easy to configure and can detect all kinds of instrusion attempts.

On the downside, if you turn on all the features it will totally dominate a CPU/machine.

SEP

[Justin Willoughby]

I want to implement IDS/9000 also but have been slowed down by all the patches and java that is required to use it.

It would be nice if all the patches and java were bundled together to make my life easier.

Oh well,

- Justin

[Rainer von Bongartz]

IDS/900 is quite good stuff.

Easy to configure as it comes with pre defined schedules.
Do not install server and agent on the same box and hopefully your boxes run 11.11. Otherwise you will have to struggle with the above mentioned patches.

Regards
Rainer