This is one of the things that truly irks me about Palo Alto's IPS/IDS implementation... I have had a lot of experience with Snort/Sourcefire IDS products, and one huge leg up over other implementations I've seen in Sourcefire's Snort is the fact that the rules are easily browsable (except for very specific situations, where "shared object" rules were written to obfuscate the rule so that the rule can't be analyzed and have an exploit written for it - that's a corner case though). It's very easy to determine if a given rule that fired off is a legitimate event or a false positive, because I can look at the rule that generated the event with a PCAP open along side the rule, and determine if this traffic match was a false positive or not. Both Check Point and PA should really "get the memo" on this... we as network security folks need to be able to see not just that some proprietary thing determined that there was "bad network traffic," but to see how the rule/signature was actually written.
... View more
