As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits of one over other? Pro's and con's? Thank you,
1 Answer
It depends on your reqirement, where you are going to use your or snort IDPS. It means, If your DMZ or network is getting attacked more frequently then you should go for Emerging Threat Pro rules because it will be updated every day so you will get protected by new attacks or might be zero day. In the other hand snort VRT paid version rules will be updated ones in a week. So there might be a chance of your IDPS can be evaded by new attacks or threat. Snort paid version rules covers all types of threat like malwares, viruses, and well known L7 protocols which is mostly used attack vector.
