Hi guys, I currently using Pfsense snort for IDS and IPS.
But I think the UI not really great and not easy to costume the rule.
I have google come up with a lots of options, I need input from who have been used IDS and IPS system.
Prefer open source, great user interface and easy custom rule
Really appreciate for all the input.

personally I use Astaro UTM. its free for home use if you have a spare pc lying around. i used to run PF and switched to it.

1 members found this post helpful.

jag2000, thanks for the input. I will have a try in office lab.
Actually will used for office but really prefer open source because of budget.
If anyone have any other input really appreciate it.

*I'd like to point out that you're responsible for gauging responses (as the first didn't actually address your concerns and didn't give any reason for switching).

Maybe you could clarify what and what mean to you. As for the latter most IDSes will initially see their rule set tuned to site specs (like why bother with IIS or Solaris sigs if you don't run them) and run automated rule management to reflect that (lots of command line tools available for which you don't need a user interface), so unless you're into crafting your own signatures or have specs changing dynamically why would you need easy rule customization in the first place...

Maybe you could clarify what
great user interface

System that have build in snort and build in analysts full packet web based snorby example smoothsec or security onion.
Considering of other people easy to used.

easy custom rule
any program that can help to create local rule just type requirement will automatically create snort rules.
Example filter for RED 5 traffic with specific parameter need to be excluded for security purpose.

Thanks.