Threat Prevention TP Update (removes reference to higher end product if you are not using it)

[Jan Janowski]

Still on SRM 1.2.5-5... TP informs it has an update.... (V1.2.5-0805)
I'm still awaiting Signatures to be updated, but it now says it will remove higher end (PRO) access reference if you were not using them already...
I'm not...
After Database load.... to USB Drive.... and updates itself....

I don't see anything else obviously different... There was a post somewhere that indicated an export pulldown.... I do not see that.....

I'm using an M.2 drive in USB3 enclosure (at USB3 speeds) for TP & Logs... and never did EXT 4 format... (NTFS is what it says in Storage).... I'm assuming that after the fact I cannot do EXT 4 format? (During the Database load TP is Prompting EXT4 format would be faster)... Or can you????
Would like to hear about folks that used EXT4... Even with the speeds of M.2 in USB3, it's prompting it will take 5Min to load Database... and does....

 

[Jan Janowski]

So I figured.... Experiment (TP has always been pretty stable here)....

So I go into Storage/Storage and format the M.2 on USB3 as EXT4....

Obviously I have to reload TP and Database again.... (Yes, I first saved my Custom Rules to Desktop after the TP update, which I will re-load after the Database get's re-built!!!)

But, Surprise--Surprise!! Once M.2 gets re-formatted as EXT4, and Database starts re-building....
TP Still prompts during the Re-load of Database that I really should use EXT4, as it is faster!!!!

I DID!!! Awaiting rebuild to see if it is faster...

-- post merged: 1. Sep 2022 --

The re-load of the TP configuration is no faster, and maybe a bit slower than NTFS.... (slower transfer from PC to TP/USB -- Or, maybe the conversion from NTFS to EXT4??)
Now awaiting TP to Restart...
That Restart is faster...
Time will tell!!!!

PS: re configured LOGS to point to the USB Drive... (had been disconnected due to EXT4 format)...
Back to where it was prior to this experiment!! !

 

[fredbert]

Have you seen how much the ET Pro subscription is? The only price I can find is €880 per year, presumably excluding sales taxes. I concluded some time ago that this was an expense I wasn't going to have.

 

[Jan Janowski]

No.. Never got to anyone representing the company who would answer. three people said they knew of the product, but in each case emails and forwarding of emails requesting information, resulted in Crickets as an answer... So losing that option now will result in Crickets from me, too! , as they certainly weren't pushing it at all as a product... As a product, I do appreciate TP... (Why I was looking for upgrade info!) There's been a few false positives, and my custom rules are many, but, it has opened my eyes to something I was un-aware of.... and appreciate greatly now!

No problems with TP or EXT4 on M.2 upgrade I've seen so far....

Now, I was expecting old TP Events to be lost, but I was also expecting old LOGS to be lost as well.... As the Logs had to be re-pointed to the M.2 on USB3 drive after EXT4 format....
Yes, old TP Events were Lost....
But NO, once I re-pointed Logs to the M.2 on USB3, the old logs were still there!!! ??
Could it be that logs are stored on local ram, and we just point them to an external device??

Again, all this happened on SRM 1.2.5-5

 

[Jan Janowski]

Few day update since the change to EXT4 format on M.2 in USB3 enclosure at USB3 speeds connected to 2600 for TP & LOGS: Still running fine.