Re: Wolf, wolf!
We use it also, and have about one per month for the last couple years, of course we take the time to manage KL with proper white list, restrictions (gad there are so many settings) alerts and what not. We are at the point now that we know "every" piece of software on the systems, all ports not used are locked down, IP restrictions in place. The closest to regular false positives we get now are internal pen test tripping KL - which is good. I know its working.
Biting the hand that feeds IT
