Simply because the "attacker" is our internal Mailserver and I can guarantee it's not compromised nor is this host infected. My focus was to point out that the end system is not vulnerable because it's not Lotus Domino LDAP Service running on it, and therefore it's a false positive. At the Moment PAN just does not know better about the victim, because it lacks the required intelligence. But I agree with you the attack pattern could still be a match against the IPS signature for this vulnerability, but I don't want to get alerted in the middle of the night just to find out that the system is not vulnerable, not even the right OS or Service for a successfull attack, but the IPS has fired... From my experience with several other standalone IPS vendors, be it McAfee Tipping Point or ISS, false positives are a pain. That's why Sourcefire for example has partnered up with Qualys to make a more reliable IPS (called 3D if I remember correctly) with less false positives. I believe that's to way to go. Roland
... View more
