CCNP Security IPS 642-627 Official Cert Guide

Chapter 14. Improving Alarm and Response Quality

Understanding how the IPS sensor can dynamically respond to an attack and also understanding the individual factors that go into the formula for risk rating are critical for optimizing the IPS sensor responses. In this chapter, you will learn the following:

• Identifying and Adjusting Risk-Rating Components: The ingredients that go into the recipe affecting risk rating, and how you can modify these as you tune the sensor.

• Operating System Fingerprinting: Understanding the relevance between a specific attack and the operating system of the victim will allow the sensor to increase the risk rating for a given signature match, depending on which operating system the victim is running.

• Global Correlation ...