Just a few extra comments.
The standard release schedule for signature updates is every 2 weeks for version 4.x sensors.
What we have experienced the last couple of months have been what we term Emergency Signature Updates.
A virus, worm, or exploit has been released that could be very damaging to the machines being attacked. We felt that we should not wait the standard 2 weeks for the release of the update to detect it. So we create the signature and release it as soon as possible. In the situations where you've seen 2 updates be released within 24 hours this is because either a second virus/worm/exploit was released in the same time frame, or there were issues with the first update that needed quick resolution.
The optimization has not been to limit the number of updates, but instead to optimize (decrease) the time between when an exploit is seen and when the sensor can detect it.
Things to keep in mind:
The signature updates are cumulative (relying on the last service pack to be installed). So you don't have to install every single one. Once you have the latest service pack installed you can simply install the latest signature update and skip the ones inbetween. So if you don't have time to apply one before the next update comes out, then simply skip it because the signatures are included in that latest update.
The sensor does have an automatic update mechanism that you can use to assist in deploying the updates.
You would still have to manually download the update from CCO, but then you just place it on your own ftp (or scp) server. You configure the sensors to check for new updates on your ftp (or scp) server every couple of hours.
So once you've downloaded the file and placed it on your ftp (or scp) server all of your sensors could be updated within just a few hours with no extra work on your part.
SIDE NOTE: If using IDS MC, the IDS MC team recommends deploying the updates through IDS MC instead of using the automatic update feature in order to keep the IDS MC and sensors in sync.
