Snort vs Suricata
-
Is there a good free rule set for suricata?
-
Is there a good free rule set for suricata?
The only two I know of are Snort VRT and Emerging Threats Open. Snort VRT will suffer from the "not all rules can be loaded" problem I mentioned. Emerging Threats Open does not have quite as much "threat coverage" as the paid version and it is updated less often. By "threat coverage" I mean the free ET-Open rules will never get all of the rules in the ET-Pro paid versions. I don't know the exact algorithm, but similar to how Snort VRT works with paid versus free subscriptions, paid versions get immediate updates while the free versions get most of the same updates on some time-delayed basis. That time delay is 30 days for the Snort VRT rules.
Bill
-
Wow. That is a huge consideration. What does the paid subscriptions cost if I may ask?
-
Wow. That is a huge consideration. What does the paid subscriptions cost if I may ask?
Snort VRT is $29.95 per year for individuals. Emerging Threats Pro is nearly $500/year last time I checked. $30 I can handle for a home network, $500 is a bit much… :) just for home use.
Bill
-
Snort VRT is $29.95 per year for individuals. Emerging Threats Pro is nearly $500/year last time I checked. $30 I can handle for a home network, $500 is a bit much… :) just for home use.
Bill
Proofpoint has jacked up their prices for new customers since they bought out Emerging Threats. The ET Pro Ruleset subscription is now $900 per sensor. The IQ Risk Rep List is no longer offered as a separate product. You now need to pay them a minimum of $24 000 per year (depends on the number of users) to get access as part of their ET Intelligence product (which includes access to their Global Threat Database). If you had an old subscription they have grandfathered the pricing but I don't know how long this will last. So they are now completely out of reach for home use and for most businesses for the IQ Risk Rep List.
-
Snort VRT is $29.95 per year for individuals. Emerging Threats Pro is nearly $500/year last time I checked. $30 I can handle for a home network, $500 is a bit much… :) just for home use.
Bill
Proofpoint has jacked up their prices for new customers since they bought out Emerging Threats. The ET Pro Ruleset subscription is now $900 per sensor. The IQ Risk Rep List is no longer offered as a separate product. You now need to pay them a minimum of $24 000 per year (depends on the number of users) to get access as part of their ET Intelligence product (which includes access to their Global Threat Database). If you had an old subscription they have grandfathered the pricing but I don't know how long this will last. So they are now completely out of reach for home use and for most businesses for the IQ Risk Rep List.
Jesus Christ..$500….damn. I agree with you that is too much. Not a little too much, a lot too much.
Well, you are making my decision a little easier here.
Both snort and suricata have free rules but suricata is obviously less effective with infrequently updated rules. Snort is in the same boat but the free rules for it are more complete and updated a little more frequently than ET rules. Outside of this, both do similar web traffic inspection with little difference in terms of effectiveness and speed; although suricata has some newer inspections techniques than snort.
Did I sum that up correctly?
-
I have a grandfathered ET Pro Ruleset which is about $425/yr… For a business its well worth it, as it has all of the latest rules, and not all of the new rules end up in the ET Open ruleset.
For ET IQRisk, they should offer a smaller subset of the categories for Home-Use at a more economical cost... I have a developers access to IQRisk, and the listed IPs that are usually not listed in other Free IP Lists...
-
Yeah, I agree the Proofpoint stuff has gotten out of reach for home use unless you are the spoiled kid of a billionaire … :). The Snort rules at $29.95/year are well within a home use budget.
Bill
-
I would happily pay $29.95 for something like this.
-
Ok, I know this is an older post but wanted to update that ET Pro is now $750/year. Total sticker shock on that one and out of reach for home and most small business users. So if you combine that with Snort VRT for a small business, you are over $1000/year. Can't sell that to any of my clients.