Sourcefire IPS and Passive Vulnerability Management

Traditional IDS systems provide poor ROI as they create a monitoring burden which consumes too many man hours per month. This means they are ultimately often not monitored properly, or they are expensive over their lifetime.

Additionally, traditional IDS and IPS systems have no contextual knowledge to assist with their decision making. Sourcefire IDS and IPS solutions passively build an asset database of all observed hosts, profiling their behaviour and recording possible vulnerabilities. This allows the Sourcefire system to alert only when systems are the target of traffic which corresponds to services the host offers, and vulnerabilities it may possess.

The Real Time User and Network Awareness features built into every Sourcefire sensor also capture metadata for correlation and reporting, and allow arbitrary alerts to be set for observed behavioural change, policy violations and other user defined criteria.