Re: [Snort-sigs] Snort 2.8.6.1 EOL Reminder

["Jefferson, Shawn" <Shawn.Jefferson () bcferries com>]

I've been curious what the differences between the ET paid rules and the VRT subscription rules are? I'm hoping this 
can be discussed without opening a huge flame war. :)  For background, I'm currently running the VRT subscription rules 
with the ET free rules.

For instance, the VRT is part of the MS program that releases vuln data early (and typically these rules are .so 
rules).  Does ET get this data?  How do they deal with non-disclosure, since I think all the rules are text based?

For the most part, is everything in the VRT ruleset covered in the ET ruleset?  Could I drop VRT for instance and just 
run ET pro?




-----Original Message-----
From: L0rd Ch0de1m0rt [mailto:l0rdch0de1m0rt () gmail com] 
Sent: Thursday, December 01, 2011 1:06 PM
To: Joel Esler
Cc: snort-sigs () lists sourceforge net; snortusers () googlegroups com; snort-users () lists sourceforge net Users; 
Snort-Signatures
Subject: Re: [Snort-users] [Snort-sigs] Snort 2.8.6.1 EOL Reminder

Thanks for the reminder, Joel.  Those who can't upgrade to a newer or newest version of Snort, or wish to use a 
different ruleset alongside, or instead of the VRT set, should definitely check out Emerging Threats Pro -- 
http://www.emergingthreatspro.com/.  The Emerging Threats Open rules are free and updated almost daily to respond to 
the latest threats and I have found them to be quite effective, timely, and properly QAed.  There are also some you can 
pay for as well (cheaper than VRT I think); see http://www.emergingthreatspro.com/products/ for details.

Emerging Threats Open/Pro supports rules for Snort 2.4.0 up to the current version, as well as rules optimised for 
Suricata (http://www.openinfosecfoundation.org/index.php/download-suricata).
Personally, I like https://rules.emergingthreatspro.com/open-nogpl/.

That said, if you are still running an older version of Snort, I highly encourage you to update since there are a lot 
of new and extremely helpful features in newer versions that allow for more accurate and efficient rules.

Cheers,

-L0rd Ch0de1m0rt

On 11/28/11, Joel Esler <jesler () sourcefire com> wrote:
> As a reminder, today's rule release marks the last rule release for 
> Snort
> 2.8.6.1:
>
> http://blog.snort.org/2011/11/vrt-rule-update-for-11282011.html
>
> Please upgrade to the current version of Snort (2.9.1.2) available at 
> http://www.snort.org/snort-downloads
>
> Our EOL policy and dates of EOL for Snort versions can be found here:
>
> http://www.snort.org/vrt/rules/eol_policy
>
> Thanks!
>
> --
> Joel Esler
> Senior Research Engineer, VRT
> OpenSource Community Manager
> Sourcefire

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a definitive record of customers, application 
performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. 
And common sense.
http://p.sf.net/sfu/splunk-novd2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure 
contains a definitive record of customers, application performance, 
security threats, fraudulent activity, and more. Splunk takes this 
data and makes sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-novd2d
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!