SG UTM

Suggest, discuss, and vote on new ideas for SG UTM. The ultimate network security package.

Suggest an Idea...

Introduce Behavior and Reputation Based IPS Signatures

There are Snort based IDS rule sets that provide behavior and reputation based rules which do not currently appear to be available in the UTM. Current IPS rules are insufficient to detect connections from known malicious hosts. Further, we have experienced fairly large brute force attacks against open RDP ports (business requirement) , that went undetected by the UTM IPS.

Example Rules:
Emerging Threats - ET CINS Active Threat Intelligence Poor Reputation series signatures
Emerging Threats - ET SCAN Behavioral Unusually fast Terminal Server Traffic

4 votes
Sign in
(thinking…)
Sign in with: Facebook Google Sophos Features & Ideas Laboratory
Signed in as (Sign out)

We’ll send you updates on this idea

Anonymous shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

0 comments

Sign in
(thinking…)
Sign in with: Facebook Google Sophos Features & Ideas Laboratory
Signed in as (Sign out)
Submitting...

Feedback and Knowledge Base

icon-data-protection icon-endpoint-protection icon-phish-threat icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-central icon-sophos-mobile icon-sophos-utm icon-sophos-utm icon-sophos-utm icon-web-appliance icon-xg-firewall icon-xg-firewall icon-avid-secure icon-lightbulbCreated with Sketch.