Describe the attack detection techniques your product uses.
Does the product use stateful analysis? If so, describe its use.
If malicious activity is detected, what response capabilities does your product have (allow, deny, and so on)?
What host resources are analyzed (network, memory, file, registry, and so on)?
How is data gathered (system call interception, and so on)?
Does the product conduct packet inspection? If so, describe how.
Does the HIPS have any remediation capabilities? If so, describe them.
False positives are an issue for most HIPS products. If we encounter false positives with your products, how do we tune them?
Is there a tuning, learning, or testing mode?
Describe the impact your product has on host performance (processor usage, memory usage, latency, and so on).
What information do logged events contain?
Can event severity be modified?
What types of signatures/policies are used (atomic, stateful, and so on)?
What triggering mechanisms does your product use (pattern detection, anomaly-based, behavior-based, and so on)?
Can signatures/policies be customized or created?
Does the product have any application-specific signatures/policies? If so, what applications are included?
What self-defense capabilities does the product have?
Does your product have the capability to detect or stop known attacks? How?
Does your product have the capability to detect or stop unknown attacks? How?
Does your product have the capability to detect or stop network worms? How?
Does your product have the capability to detect or stop Trojans? How?
Does your product have the capability to detect or stop spyware? How?
Does your product have the capability to detect or stop adware? How?
Does your product have the capability to detect or stop viruses? How?
Does your product have the capability to detect or stop traditional hacking attempts? How?
Does your product have the capability to detect or stop encrypted attacks? How?
Does your product have the ability to control bandwidth utilization? How?
Does your product have the ability to enforce acceptable use policies (peer-to-peer file sharing, pornography, and so on)?
Does your product have the ability to enforce security policies (confidentiality of data and so on)?
Can your product isolate malicious traffic/hosts?
Can your product overcome evasion techniques? How?
How are configuration changes distributed?
Are languages other than English supported? If so, describe the level of support and list the languages.
If the product fails, does it fail open or closed?
What happens to the HIPS if the management solution fails?
If the host is offline, what happens to the HIPS? Are events cached?
Can host software be hidden from the end user?
Does the HIPS display any messages to the end user? If so, describe them.
Does the installation require a reboot?
Do signature/policy/engine updates require a reboot?
What format does the HIPS installation package use (InstallShield, MSI, and so on)?
What software distribution mechanisms can be used to distribute the HIPS (Microsoft Systems Management Server, Radia, Altiris, CD, e-mail, and so on)?
Are administrative rights required for install?
Does the product have an unattended silent install capability?
Does the product support user-based profiles? If so, describe how they work.
Does the product support location-based profiles? If so, describe how they work.
Please describe the current roadmap for future product releases.
Is the product centrally managed?
Describe the management interface.
Does the management solution have a database component? If so, what type of database?
What architectural options are supported (single-server, tiered, hierarchical)?
How many hosts can each architecture (single-server, tiered, hierarchical) support?
Describe the high availability and failover capabilities of the management solution.
How do administrators access the management interface?
How are administrators authenticated?
How is administrator-to-management communication secured?
Is there an audit trail? If so, describe it.
Is role-based administration supported?
How many events can one management server store?
How many events per second can one management server handle?
What are the bandwidth requirements? Describe the communication protocols between the managed hosts and the management server.
How does management avoid denial-of-service because of event flooding?
Can a policy/signature be backed out?
What capabilities does the management offer for signature/policy testing before they are deployed?
Does the management solution provide a detailed status of the hosts it manages? If so, describe the details that are provided.
Describe any centralized notification/alerting capabilities.
Are events collected in real time?
Are alerts delivered in real time?
How can alerts be delivered (e-mail, SNMP, and so on)?
How is device-to-management communication secured?
How is the management infrastructure itself secured?
If your product requires updates, how are the updates distributed? Is it automatic?
How are configuration changes distributed?
Are languages other than English supported? If so, list them.
Can logs be exported?
Describe any capability to group managed hosts.
Does the management solution provide detailed status of the devices it manages?
What happens if the management solution fails?
Can logs be exported?
