Patent ID: 7331061

Claim:
A computer-implemented method for managing computer security information comprising the steps of: acquiring a packet from an information stream; determining whether an intrusion detection system (IDS) has been placed in a monitoring mode; performing a first evaluation of the packet with a firewall by comparing the packet with one or more firewall rules and classifying the packet with the firewall based upon the comparison, wherein the classifying step comprises a determination by the firewall of whether the packet should be deemed as trusted; generating firewall status information by the firewall using the first evaluation of the packet made by the firewall, wherein the firewall status information comprises the determination made by the firewall with respect to the packet; communicating the packet and the firewall status information from the firewall to the intrusion detection system for a second evaluation; if the packet is deemed by the firewall as trusted, then sending the trusted packet irrespective of the second evaluation and determination by the intrusion detection system, and sending a copy of the trusted packet to the intrusion detection system for the second evaluation; performing the second evaluation within the intrusion detection system by evaluating the packet and the firewall status information communicated from the firewall; and determining whether to send or drop the packet using the intrusion detection system based upon at least one of the firewall status information and the intrusion detection system evaluation.