Symantec's On a 'ManHunt'

Symantec will release version 4.0 of its Intrusion Detection System in October, and released its version of ManHunt on Monday.

by Michael Singer of siliconvalley.internet.com [September 24, 2002]

Symantec, the maker of Norton-brand anti-virus software, Monday unveiled its version of ManHunt, a multi-gigabit intrusion detection and prevention product line that it recently acquired with the purchase of Recourse Technologies.

The Cupertino, Calif.-based company also announced the pending release of its own Symantec Host Intrusion Detection 4.0.

Symantec's new ManHunt product offers protocol anomaly detection for known and unknown or "zero day" attacks, signature detection with custom signature support, and behavioral anomaly analysis or statistical flow analysis intrusion detection for denial of service attacks (DoS), at speeds of up to 2 gigabits per second, depending upon system configuration.

The company said the platform could be customized to include on session termination, FlowChaser technology (which traces attacks back to their ingress point), quality of service filters, traffic recording and handoff responses.

The newest version of Symantec Host IDS gives security techs real-time monitoring and detection of and response to security breaches. For example, if systems are threatened, Host IDS will notify administrators with an alarm and take countermeasures according to pre-established security policies to prevent the loss or theft of information.

The software includes specialized software agents to support server platforms running Windows 2000 and can be configured to monitor Web or database applications running on Windows 2000 servers.

"Our customers have told us that the two key elements they need are the ability to detect intrusions at multi-gigabit speed networks and deliver intrusion prevention," said Symantec executive vice president Gail Hamilton.

The company said it is planning to offer a combination of ManHunt and Symantec Host IDS, slated to be available in the December quarter. The idea is to provide better recognition and response to attacks by correlating IDS data from both the host and the network.

Symantec ManHunt and Symantec ManTrap (its "honeypot" product) are available now. Symantec Host IDS 4.0 is scheduled to be available by mid-October.

— End