Why do Sophos have so litel signiture? On pfsense with snort, i have 5 times more, with all optios (Oracle, user agent, netbios,apache, ntp, ftp, smtp,..., .).
Hi simby. What kind of numbers pattern-wise are you looking for? In total we have ~18000 signatures. of course, many of those will be irrelevant for your network, (old, unneeded, low risk, etc...) and we have spent a lot of development man-hours on optimizing the rule set and intelligently applying patterns, including a new age-dating system.
If you have some more info to share around your thoughts there, let us know. I am particularly interested if you have experienced any threats getting through your UTM that were caught by PFsense, or if not running both in a chain, if you had any threats penetrate your UTM with IPS enabled that could have been solved by a "missing" pattern.
Hi Simby,
do you mean the number of Groups of rules. Thats a thing i told before to astaro and now to sophos. The granularity of the aktivating/deaktivating of rules is not optimal in my opinion.
My wish is that i want to have more options to manage the rules.
The possibility of deaktivating rules by now are a little bit insufficient.
The Options to manage the events are a bit to small too.
Other Solutions give you much more, maybe you can see wich website/url was loaded while a Packet was dropped, or wich Mail is not delivered while an appendix is seen as bad or the filename of an appendix in wich an packet was dropped.
But dont understand this wrong i dont want to say use an other solution than the Sophos UTM my wish is to get the UTM better than now. Otherwise some may get an other solution for IPS cause their company wishes more. (i told this as an platinum service company user to Sophos).
Hi Simby,
do you mean the number of Groups of rules. Thats a thing i told before to astaro and now to sophos. The granularity of the aktivating/deaktivating of rules is not optimal in my opinion.
My wish is that i want to have more options to manage the rules.
The possibility of deaktivating rules by now are a little bit insufficient.
The Options to manage the events are a bit to small too.
Other Solutions give you much more, maybe you can see wich website/url was loaded while a Packet was dropped, or wich Mail is not delivered while an appendix is seen as bad or the filename of an appendix in wich an packet was dropped.
But dont understand this wrong i dont want to say use an other solution than the Sophos UTM my wish is to get the UTM better than now. Otherwise some may get an other solution for IPS cause their company wishes more. (i told this as an platinum service company user to Sophos).
