When a packet is sniffed by the IDS, I get a warining, fine. But hwre is the attacking packet actually saved ? It's necessary in somce case to identify false positives and it's also usually needed when talking with 3rd party ISP (that is: when I complain about an intrusion attempt, I need to have the evidence somewhere, not just the conclusion from the filter).
Another situation where is could be critical: iif I ever see any attack RESPONSe. In such case, having the extact attack packet that was responded to will help me identify the problem way faster (e.g. the cmd.exe attack rule and prompt attack response: I know that if my web server sends back a command prompt back after an HTTP request, chances are this isn't good. But in order to know what command was used to trigger that answer and plug the hole, I need to get the full URL used in the attack packet)
This thread was automatically locked due to age.
