<div dir="ltr">Absolutely. Let me chat with one of my guys and we'll work out an automated method.<div><br></div><div>We can modify our testing frequency and window if it's helpful as well.</div><div><br></div><div>I'll get back to you within the week with something.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 9, 2016 at 12:49 PM, Will Metcalf <span dir="ltr"><<a href="mailto:william.metcalf@gmail.com" target="_blank">william.metcalf@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><span class=""><span style="font-size:12.8px">>We've been happy with ET for year, but we have noticed an increase in the number of rules we've had to disable due to unreasonably high percentages of CPU time. </span><span style="font-size:12.8px">We do profile on a large sample set (~7Gbps for 10 minutes) daily.</span><br><div><span style="font-size:12.8px"><br></span></div></span><div><span style="font-size:12.8px">Would you be willing to share these stats off list? I would love to take a stab at trying to optimize the worst offenders, additionally I don't think there is any super sensitive information in the rule perf stats.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Regards,</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Will</span></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 9, 2016 at 10:56 AM, Brandon Lattin <span dir="ltr"><<a href="mailto:latt0050@umn.edu" target="_blank">latt0050@umn.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">We've been happy with ET for year, but we have noticed an increase in the number of rules we've had to disable due to unreasonably high percentages of CPU time. We do profile on a large sample set (~7Gbps for 10 minutes) daily. I have no doubt that you guys do your best testing, but we have a large network with a lot of students and researchers doing some very weird things. We get that it's as much an art as it is a science.<div><br></div><div>As for the price whispers I'm hearing from legal, I guess we'll let the lawyers figure it out.</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 9, 2016 at 10:41 AM, Will Metcalf <span dir="ltr"><<a href="mailto:william.metcalf@gmail.com" target="_blank">william.metcalf@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I'm sorry that you feel our rule quality has declined. We test rules for perf/fp's before they go out each day on a live sensor network and with a collection of QA pcaps. That said the straight poop is every network is a snowflake and determining performance impact of a rule in a specific network without a feedback loop is impossible, it's an educated guess at best. As a PRO customer you are more than welcome to open a support ticket. With additional info about your environment we can help try to tune the rule with you. Alternatively you can simply disable it, or look at using Lua to detect a multi-byte encoded xor'd executable although I doubt this will be any cheaper perf wise. Additionally I would be weary of relying on suri rule perf stats outside of single threaded mode during short runs to sample rule perf. In my experience they tend to be unreliable even with the same rules/networks across runs. Victor can correct me if I'm wrong but afaik they are unreliable in these modes as they include lock wait time which should level out over long runs. BTW we have no plans to raise prices that I'm aware of :). <div><br><div>Regards,</div><div><br></div><div>Will</div></div></div><div class="gmail_extra"><br><div class="gmail_quote"><span>On Tue, Feb 9, 2016 at 9:36 AM, Brandon Lattin <span dir="ltr"><<a href="mailto:latt0050@umn.edu" target="_blank">latt0050@umn.edu</a>></span> wrote:<br></span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">I'm sure some of you are aware that Proofpoint has acquired Emerging Threats.<div><br></div><div>We've seen a decline (perhaps anecdotal) in rule quality - to the tune of a single new rule (2815810) taking 49% of total CPU time. Additionally, it would appear they are planning on raising prices.</div><div><br></div><div>I'm curious if anyone is using an alternative to the ET Pro set.</div><div><br></div><div>Thanks!</div><span><font color="#888888"><div><div><br></div>-- <br><div><div dir="ltr">Brandon Lattin<div>Security Analyst<br><div>University of Minnesota - University Information Security<br>Office: <a href="tel:612-626-6672" value="+16126266672" target="_blank">612-626-6672</a></div></div></div></div>
</div></font></span></div>
<br></div></div><span>_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br></span><span>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 9-11 in Washington, DC: <a href="http://oisfevents.net" rel="noreferrer" target="_blank">http://oisfevents.net</a><br></span></blockquote></div><br></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr">Brandon Lattin<div>Security Analyst<br><div>University of Minnesota - University Information Security<br>Office: <a href="tel:612-626-6672" value="+16126266672" target="_blank">612-626-6672</a></div></div></div></div>
</div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">Brandon Lattin<div>Security Analyst<br><div>University of Minnesota - University Information Security<br>Office: 612-626-6672</div></div></div></div>
</div>