Snort Engines

Trellix IPS NS-series Sensors running on software version 9.2 and later support either of the following Snort engines:

• Trellix IPS Snort
• Suricata Snort

Note

A Sensor can run only one of the above engines at a time.

The Trellix IPS Snort engine is the existing Snort engine available on Trellix IPS, whereas the Suricata Snort engine is new. If you need support for a wide range of Snort rules, use the Suricata Snort engine.

You can select a Snort engine at the global level and override the selection per admin domain and/or Sensor, as necessary. The Advanced Device Settings page at the global and device levels allows you to select the engine you prefer to use.

Note

The default selection is Trellix IPS Snort.