A security analyst has entered the following rule to detect malicious web traffic:alert tcp any...

GIAC GSEC Question Answer

A security analyst has entered the following rule to detect malicious web traffic:

alert tcp any -> 192.168.1.0/24 SO (msg: Attempted SQL Injection!"; sld:20000O01;)

How can this rule be changed to reduce false positives?

Change the rule to make it apply bi -directional to source and destination

Add more detail in the rule to make it more specific to the attack pattern

Add an additional rule to apply to destination port 443 as well as 80

Make the IP range more general so that it applies to all webservers

GIAC GSEC Summary

Price: $52.5 ~~$149.99~~