[SOLVED] EmergingThreats.Net

Jim Bengtson · 10-26-2009, 09:51 AM

I ran across this site today, which looks very interesting. Has anyone heard of them before? Are they for real?

Quote:

About Emerging Threats
http://www.emergingthreats.net/index...inmenu-43.html

Emerging Threats is an open source community project. Through the support of our community we are able to produce the fastest moving and most diverse Snort Signature set and firewall rules available. Other related projects find a home here as well. Matt Jonkman manages this project.

Our content is free to use by any user or organization, commercial or private. We only ask that when you detect new threats in your environment or write new rules suitable for public release that you share that intelligence with the community at large. We update these rulesets as new information surfaces (usually several times a day 7 days a week) and highly recommend you update at least twice a week to stay up to date. Daily is your best bet.

Emerging Threats has been in operation under several names for over 5 years. We were formed originally as Bleeding Snort, but had to remove Snort from our name several years later when Sourcefire went public. We then became Bleeding Threats. That project had to be abandoned and is defunct unfortunately because of some possible license conflicts that appeared to be arising, so the entire ruleset was moved here, to Emerging Threats. In 2008 we received grant funding from the Army Research Office and the National Science Foundation to continue this project and research.

MS3FGX · 10-26-2009, 09:56 AM

Can't say I have any experience with them personally, but it looks interesting. Would like to see if anyone else has dealt with them in the past.

unSpawn · 10-26-2009, 11:30 AM

Quote:

Originally Posted by Jim Bengtson

Has anyone heard of them before?

Yes. Been using their rules since they were called Bleeding Snort.

Quote:

Originally Posted by Jim Bengtson

Are they for real?

Definately are. The obvious problem with Snort becoming Sourcefire was that paying customers gained instant rule access while non-paying users (who actually may have even helped Snort by developing and modifying rules and promoting the SW) were forced to wait a period. Emerging Threats rules are free and updated regularly.

unixfool · 10-27-2009, 08:18 AM

Quote:

Originally Posted by unSpawn

Definately are. The obvious problem with Snort becoming Sourcefire was that paying customers gained instant rule access while non-paying users (who actually may have even helped Snort by developing and modifying rules and promoting the SW) were forced to wait a period. Emerging Threats rules are free and updated regularly.

I believe when Sourcefire releases new/revised rules, they initially give them to their subscribed customers, then release them to the the non-subscribed a week later.

I'm pretty sure you're aware of this (and I'm gonna summarize, so those who may poke holes later, just be aware that I'm trying to avoid a long and winded account of things), but the word is that Sourcefire was concerned that there were a lot of corporate entities that were using their rules and not contributing to them, to the extent that some were actually making money off of their rules. They wanted to prevent abuse of their good nature, I believe. Not that I agree or not agree.

unSpawn · 10-27-2009, 11:43 AM

Quote:

Originally Posted by unixfool

They wanted to prevent abuse of their good nature, I believe.

Sounds reasonable. And compared with how some commercial vendors try to protect their market share they're still very lenient.