Threat Prevention ET pro vs ET open?

[horizonbrave]

Please any enlightening?
Cheers

 

[Rusty]

Please any enlightening?
Cheers

What would be your question here exactly?

 

[horizonbrave]

which would be advantages and disadvantages of using one ruleset or the other please

 

[horizonbrave]

from Proofpoint itself:
"The Proofpoint ET Open IPS/IDS ruleset collects submissions from one of the largest and most active IDS/IPS rule-writing communities and includes never-seen-before threats. This continually updated list of rules enables monitoring engines to automatically detect and block known, advanced threats. This is an opensource product.
Proofpoint ET Pro Ruleset is a commercial ruleset atop the open IDS ruleset and added support for the Suricata platform. The Proofpoint research team tests all rules for optimum performance and accurate detection. Licensing costs USD$900 per sensor"

 

[Shadow]

The way I see it, ET pro may be valuable if you are a hosting/cloud company or something. If you then want to use Threat Prevention to it's fullest potential with all the available support, ET pro is an option.

Altough I would highly doubt using Synology routers in an enterprise-like environment, especially cloud-providers. Think I would stick to professional network gear from Cisco, Juniper or HP or something.

 

[Rusty]

Well I run it with Open option

 

[fredbert]

ET Open cos I'm a tight wad.

For a home / small environment you'll get more than enough alerts and you won't know what to do because there isn't enough information for a normal person to make a decision. Set it with default rules and alerting (email, notifications) and see what you get for a while. You can then decide if some rules that just alert can be changed to drop, and add specific rules too.

Also review the map to get an idea of countries you can start to blanket drop incoming requests using the SRM firewall, if you aren't already doing this with 'allow my country' and 'drop all other requests' rules.

 

[fredbert]

Just found this resource that lists the updates to the ET Open and ET Pro rules. It provides an interesting view on what the Pro rules add and would a home user normally need to stump up the $$$ for a licence.

Daily Ruleset Update Summary | Proofpoint US

Get daily technical security updates from the Proofpoint Threat Operations Center experts.

www.proofpoint.com

Emerging Threat Intelligence - Cyber Threat Solutions | Proofpoint US

Discover how Proofpoint emerging threat Intelligence delivers timely and accurate cyber threat intelligence to provide deeper context and seamless integration with security tools.

www.proofpoint.com