IDS and VAM correlation rule

[RSAAdmin]

Does anyone have an example of a correlation rule that 1. An IDS alert fires with an attack against a certain Microsoft patch MSxx-xxx. 2. Cross references the VAM data to see if the asset is vulnerable to the IDS attack

or any other IDS and VAM correlation

[FIRSTNAMELASTNA]

Hello - I am in same boat - Please someone guide ?

[RSAAdmin]

There is a tutorial for this exact thing in the blogs section of the Intelligence Community. Here is a link to the tutorial: [[page no longer exists]]

[RSAAdmin]

Watch the video that Matt posted, its pretty good. Essentially all you have to do is apply Confidence Level Filtering in your alert. If you have your VAM properly setup (Foundstone broke in 4.1, so if you use that don't upgrade!!) then envision will correlate the Message ID of the IDS alert to the CVE of your vulnerability. It does this using the internal NIC VID.