We just raised a $30M Series A: Read our story

Cisco Sourcefire SNORT OverviewUNIXBusinessApplication

Cisco Sourcefire SNORT is #10 ranked solution in top Intrusion Detection and Prevention Software. IT Central Station users give Cisco Sourcefire SNORT an average rating of 6 out of 10. Cisco Sourcefire SNORT is most commonly compared to Cisco Stealthwatch:Cisco Sourcefire SNORT vs Cisco Stealthwatch. The top industry researching this solution are professionals from a comms service provider, accounting for 32% of all views.
What is Cisco Sourcefire SNORT?

Snort is an open-source, rule-based, intrusion detection and prevention system. It combines the benefits of signature-, protocol-, and anomaly-based inspection methods to deliver flexible protection from malware attacks. Snort gained notoriety for being able to accurately detect threats at high speeds.

Cisco Sourcefire SNORT was previously known as Sourcefire SNORT.

Cisco Sourcefire SNORT Buyer's Guide

Download the Cisco Sourcefire SNORT Buyer's Guide including reviews and more. Updated: November 2021

Cisco Sourcefire SNORT Customers

CareCore, City of Biel, Dimension Data, LightEdge, Lone Star College System, National Rugby League, Port Aventura, Smart City Networks, Telecom Italia, The Department of Education in Western Australia

Cisco Sourcefire SNORT Video

Cisco Sourcefire SNORT Reviews

Filter by:
Filter Reviews
Industry
Loading...
Filter Unavailable
Company Size
Loading...
Filter Unavailable
Job Level
Loading...
Filter Unavailable
Rating
Loading...
Filter Unavailable
Considered
Loading...
Filter Unavailable
Order by:
Loading...
  • Date
  • Highest Rating
  • Lowest Rating
  • Review Length
Search:
Showingreviews based on the current filters. Reset all filters
ITCS user
Lead Program Manager at a computer software company with 10,001+ employees
Real User
Top 5Leaderboard
Intelligent with good threat detection capabilities but could be easier to implement

Pros and Cons

  • "It is quite an intelligent product."
  • "The implementation could be a bit easier."

What is our primary use case?

The product is primarily used for an IDS, Intrusion Detection Software, element.

What is most valuable?

You can do a lot of feasibility in terms of SSLI configuration which can be enabled.

You can encrypt and encrypt your data through Cisco Sourcefire so that your IPS solution can be effectively utilized.

Users have access to intelligent security automation as one of the features. It can easily automate your event impact assessment and your IPS policy tuning can be done as well as your network behavior analysis. They have introduced this intelligent security automation as part of that and then you can do a real-time contextual awareness. Basically, you can see a correlation of events that are created on your application, user devices, operating systems, or vulnerabilities. All of this real-time data can be captured including on your apps and port scans.

It is quite an intelligent product.

It can look into your north-south traffic in case of IPv6 attacks, DOS attacks, or buffer overflow. They say that it also supports against zero-day threats and items like that. They are up-to-date in terms of their threat protection, anti-bot, antivirus, and all kinds of signatures.

They have something called Firepower, which is advanced threat protection that they offer. It's a new subscription which we use for additional malware protection. It offers blocking capabilities and continuous analysis.

The solution is very stable.

What needs improvement?

The solution is still very new to us. Maybe if I extensively start using it on our environment I will be able to, based on the events and other things, come back with insights on features. But currently, it is quite new to us, so we are still using it and learning it.

The implementation could be a bit easier.

As long as they continue to develop security features to protect our company, they will be doing quite well.

For how long have I used the solution?

I've been using the solution for six months at this point. It's been less than a year and hasn't been that long.

What do I think about the stability of the solution?

It is quite a stable product. We have not seen many issues with this product. We haven't seen crashes or glitches or bugs. Since we have just started to use this product, we need time to understand the stability for a longer period. It's only been around six months, and we are just implementing it now across a few locations.

What do I think about the scalability of the solution?

The solution is pretty scalable. The throughput, however, depends on what kind of appliance you are buying. For example, you can have 50 Mbps to 40 Gbps of throughput. Currently, we are using 100 Mbps and, at a couple of smaller locations, we are using 50 Mbps of a throughput receiver.

We're implementing it across locations currently. We're implementing it on an enterprise level. We have close to around 15 major locations, wherein we are using it to align devices that are hosted in our data center or in our critical locations.

As we are still in the early stages, we do plan to continue to use the solution in the future.

How are customer service and technical support?

Technical support is quite fast. Cisco is quite a big company and their support contract is there with us. We use a lot of Cisco products and therefore we have platinum support for everything. Due to our level, we get immediate support from Cisco on all of our Cisco products. We're quite satisfied with the level of service provided.

Which solution did I use previously and why did I switch?

We were previously using IBM IPS. We switched due to the fact IBM wasn't really working for us. It couldn't help us solve most of our issues and the devices which we bought were also quite old. It didn't have the option of SSL encryption and other things in it. Due to all of these limitations, we decided to move away from IBM.

How was the initial setup?

The initial implementation is pretty straightforward. It's just an appliance. We are using an appliance and it is predominantly for SSL encryption. We have a lot of applications on the cloud and on the web application. 

Your IPS, DLP, everything can be done on a single appliance itself. Predominantly, we are using it for SSL encryption to a larger extent. 

It doesn't take much time for installation. It depends on what you want to and what traffic you want to allow on Sourcefire. 

For example, if I have a proxy path, where my users are accessing through a proxy path, that traffic needs to be encrypted. In cases where I have a direct path, and if I have a CMD path, it depends on where exactly you want to enable your SSL encryption or which data needs to be analyzed and used. If you have too many paths from which the users are accessing the data, then it is important that you use all the paths. If you are using it on a single path and if there are no other kinds of encryption used there, then obviously it doesn't make sense. If your traffic is going from north-south traffic, then you can use its product to ensure that your encryption and other tasks are happening.

We only need maybe one or two people for maintenance. Our data center specialist can handle the device. After implementation, it is just a configuration of our traffic. One or two people are more than enough.

What about the implementation team?

Cisco is currently helping us with the implementation process.

What's my experience with pricing, setup cost, and licensing?

We bought the appliance, which comes with a license as well.

While I don't know the exact pricing, most of these products are through subscription. In our case, we bought the complete appliance with the software with it. It does not run with any Cisco item, as we have bought the entire appliance. The three-year warranty of the appliance is there. It does not contain any licenses except for the software license and the hardware licenses which are a part of it. It's a three-year contract which we have bought.

What other advice do I have?

The solution is the latest version. We're still in the process of implementing it, and therefore are using the most recent release.

I'd recommend the solution to other organizations.

Currently, I would rate the solution at a seven out of ten. I'm not completely migrated over. I need more time with the solution to really gauge its effectiveness.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Flag as inappropriate
AE
Information Security Operations Expert at Asiacell
Real User
Top 20
Known bugs consume memory and CPU resources to the point where we are seeking a new solution

Pros and Cons

  • "The most valuable feature is the ability to automatically learn the traffic in our environment, and change the merit recommendations based on that."
  • "We are unhappy with technical support for this solution, and it is not as professional as what we typically expect from Cisco."

What is our primary use case?

The primary use of this solution is intrusion prevention, for both user-to-server traffic, and server-to-server traffic.

Most of our environment is Cisco including ISE, our access control, routers, switches, call center, and TelePresence.

How has it helped my organization?

The current solution that we are using is actually a bottleneck for us. It is negatively impacting our performance because it cannot handle our traffic. The SSL offloading did not work and gives us an error regarding resources in terms of memory and CPU. 

Other than the performance issue, this product is very good because it prevents many attacks and intrusions. We have seen this from the monitoring logs. Unfortunately, with the issue related to the system slowing down, it cannot be utilized 100%. I would like to be able to use the SSL offloading and the anti-malware features.

What is most valuable?

The most valuable feature is the ability to automatically learn the traffic in our environment, and change the merit recommendations based on that. It can tune its IPS rules automatically based on what it has learned. This feature is not available in other IPS solutions, so it is very beneficial for us. Manually tuning the IPS rules is difficult because we have thousands of them.

What needs improvement?

We are unhappy with technical support for this solution, and it is not as professional as what we typically expect from Cisco.

Sourcefire SNORT is very resource heavy in terms of CPU usage and memory consumption. Technical support has told us that this is related to bugs that have yet to be fixed.

For how long have I used the solution?

We have been using Cisco Sourcefire SNORT for three years.

What do I think about the stability of the solution?

What we are using now is not very stable and it results in performance issues that are related to memory and CPU consumption.

What do I think about the scalability of the solution?

Scalability-wise, I can see that Cisco is one of the leaders in IPS solutions. However, I cannot comment on it personally because I have not used products by other vendors for this use case.

We have many thousands of machines that are being monitoring by my team, cybersecurity. All of the production traffic goes through Sourcefire. Because of the performance issues, we are unable to use all of the features. For example, we cannot use the SSL policy or the AMP policy.

Which solution did I use previously and why did I switch?

We did use another product prior to Cisco Sourcefire SNORT but it was before I joined the company and I am unable to comment on it.

How was the initial setup?

The initial setup is straightforward and the configuration is easy.

We implemented this solution in stages because it could not be done all at once.  It took us perhaps just over a month to finish moving all of our servers from IDS to IPS, from detection to prevention.

What about the implementation team?

Our own team was responsible for the implementation. I handled all of it myself.

What other advice do I have?

A lot of Cisco equipment is very good, but in judging the model of this solution that we have, I feel that it is the worst. It has very big issues for us in terms of performance, reliability, and stability. It is slowing our network traffic down considerably.

I would rate this solution a one out of ten.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Learn what your peers think about Cisco Sourcefire SNORT. Get advice and tips from experienced pros sharing their opinions. Updated: November 2021.
554,382 professionals have used our research since 2012.
ITCS user
Team Lead at a tech services company with 201-500 employees
Real User
Top 20
Offers good protection and a huge rate of threat protection

Pros and Cons

  • "It has a huge rate of protection. It's has a low level of positives and a huge rate of threat protection. It's easy to deploy and easy to implement. It has an incredible price rate compared to similar solutions."
  • "Performance needs improvement."

What is most valuable?

It has a huge rate of protection. It has a low level of positives and a huge rate of threat protection. It's easy to deploy and easy to implement. It has an incredible price rate compared to similar solutions. It has a good support channel, technical assistance. It's good. 

It's really good to sell as far as a Cisco firewall. It's really good to sell in the complex Cisco project because Cisco's really good for networking and routing. When we are networking, it's easier to sell a security-based firewall. It's a complex product. It's really good. There is syndication between different security products, and in Cisco's case, it's with integration.

What needs improvement?

Performance needs improvement. If you compare Cisco Sourcefire with other products, it performs at the same level of compliance. For Cisco Sourcefire, it's not really horrible and it's not really the market and price-performance rate. The performance can be improved. 

For how long have I used the solution?

We have been using Sourcefire since 2011.

What do I think about the scalability of the solution?

It's scalable. Sourcefire has a classic deployment model and you can scale up through the appliance if you need the same deployment so it's quite simple. It's quite scalable. We mostly work with mid-sized companies. 

Sourcefire Snort is the kind of software that is constantly running like 24/7,

How are customer service and technical support?

In general, Cisco provides really good and reliable support. Overall it's good but sometimes, around 1% of the time, it doesn't work so well. 

Which solution did I use previously and why did I switch?

We also use IBM and Palo Alto and from the technical perspective, it's probably equal. It's equal by the features, by the functionality, by the performance. But again, for the pricing, it's really bumpy.  For Palo Alto for example, the pricing is almost equal. But for the performance and the features, they are on the next level.

How was the initial setup?

It is easy to setup. For a basic deployment, it can take up to three or four days to deploy in a minimal setup. If it's a huge project with a huge data center, a lot of configuration, a lot of work, and a lot of integration, it will take two or three weeks up to one month. 

You only need one person for a basic deployment. 

What other advice do I have?

Make sure to have good sizing because it matters for the performance of the features. Also make sure to have a good design. Before starting with the deployment and installation for Sourcefire. Have a technical session with the local Cisco office or the local department to provide a good design. 

I would rate it an eight out of ten. 

We have some architecture concerns. I'm not really sure that Cisco can quickly solve this concern. Palo Alto has a user-friendly interface for the management. 

Which deployment model are you using for this solution?

On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
SC
Team Lead with 501-1,000 employees
Real User
Top 20
Straightforward setup, easy to use, and very stable

Pros and Cons

  • "The solution is rather easy to use."
  • "While the alerts they offer are good, it could improve it in the sense that they should be more detailed to make the alerts more useful to us in general. Sometimes the solution will offer up false positives. Due to the fact that the alerts aren't detailed, we have to go dig around to see why is it being blocked. The solution would be infinitely better if there was just a bit more detail in the alert information and logging we receive."

How has it helped my organization?

The solution has improved our organization in terms of management. We don't need to have too many resources when it comes to managing it, unlike previously, when we had the IPS. It was a nightmare trying to download the signatures, and uploading them, was also a nightmare. This solution makes life a lot easier. There's fewer man-hours required.

What is most valuable?

The solution is rather easy to use. 

The signatures are uploaded and there's a set of recommended ones that we are using, which makes a lot easier than having to configure individual signatures together.

What needs improvement?

While the alerts they offer are good, it could improve it in the sense that they should be more detailed to make the alerts more useful to us in general. Sometimes the solution will offer up false positives. Due to the fact that the alerts aren't detailed, we have to go dig around to see why is it being blocked. The solution would be infinitely better if there was just a bit more detail in the alert information and logging we receive.

For how long have I used the solution?

I've been working with the solution for a long time. It's been about five to six years at this point.

What do I think about the stability of the solution?

There are no bugs or glitches. The solution doesn't freeze. It doesn't crash. It's reliable. It's very stable.

What do I think about the scalability of the solution?

In terms of scalability, I've not really had to look into it due to the fact that the devices we have are accurate for our purposes. I can't really say a lot about scalability because I've not had to. I'm sure they have got configurations where you can maybe put two or three together to scale it up if you need to.

How are customer service and technical support?

We've only reached out to technical support once when we had to do an upgrade. The team at Cisco was very helpful. They were responsive and knowledgable. We were quite happy with the level of service we were provided.

How was the initial setup?

The initial setup was not complex at all. It was very straightforward. We were able to handle it easily.

Deployment, in total, took about a week.

What other advice do I have?

We're just an end-user of the service. We don't have a business relationship with Cisco.

The hardware we're using is still old. We bought it when the product was not under Cisco. That said, obviously, Cisco has now updated the product with new hardware. However, we've still got the old hardware. 

I would advise other organizations to go ahead and try the solution out. It's a good product. It's very straightforward and easy to implement especially when you compare it to other systems.

I'd rate the solution eight out of ten overall. If they offered better and more detailed alerts, I would rank them higher.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
SS
Network Engineer at a tech services company with 501-1,000 employees
Real User
Top 20
Reliably filter URLs and malware, easy to manage and has good support

Pros and Cons

  • "The URL filtering is very good and you can create a group for customized URLs."
  • "There are problems setting up VPNs for some regions."

What is our primary use case?

Our primary uses for this solution are URL filtering and malware filtering.

How has it helped my organization?

Sourcefire SNORT has been good for us.

What is most valuable?

The most valuable feature is reliability. This solution is better than Check Point.

The URL filtering is very good and you can create a group for customized URLs. 

Cisco SNORT is easy to manage.

What needs improvement?

There are problems setting up VPNs for some regions. There are cases where they are permitted in Sourcefire but blocked in Check Point. 

There are some outside ports that are allowed by default but should not be.

It would be helpful if a list of third-party services were listed so that the rules could be easily added. An example of this would be a ticket booking site. It would be in a list of services and selecting it would allow transactions with that site.

For how long have I used the solution?

I have been working with Sourcefire SNORT for six months.

What do I think about the stability of the solution?

There are some bugs in this solution and troubleshooting them is complicated.

What do I think about the scalability of the solution?

The scalability of this solution is good.

How are customer service and technical support?

The technical support is good and is better than Check Point.

Which solution did I use previously and why did I switch?

We are also using Check Point but it does not work as well as Sourcefire SNORT, which is why we are switching. For example, customized URLs do not work in Check Point. Check Point is also more complex.

How was the initial setup?

The initial setup is straightforward.

What other advice do I have?

This is a good solution and one that I would recommend to others.

I would rate this solution an eight out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
AA
NOC Supervisor / Network Architect / System Analyst at a non-profit with 10,001+ employees
Real User
Top 20
Protects your network against various threats

Pros and Cons

  • "Cisco Sourcefire SNORT is easy to configure and the reporting is great. It's also very user-friendly."
  • "I did not experience any pain points that required improvement. Maybe a couple of false-positives, but that's about it."

What is our primary use case?

We use Cisco Sourcefire SNORT for intrusion prevention cases.

Within our organization, there are roughly 1,000 people using this solution.

What is most valuable?

Cisco Sourcefire SNORT is easy to configure and the reporting is great. It's also very user-friendly.

What needs improvement?

I did not experience any pain points that required improvement. Maybe a couple of false-positives, but that's about it.

For how long have I used the solution?

I have been using this solution for roughly four years.

What do I think about the scalability of the solution?

Cisco Sourcefire SNORT is both scalable and stable.

How are customer service and technical support?

The technical support is very good.

How was the initial setup?

The initial setup was very straightforward. Deployment took roughly two months.

What about the implementation team?

We used a reseller to help us with deployment.

Which other solutions did I evaluate?

Yes, we did evaluate other solutions before choosing Cisco Sourcefire SNORT.

What other advice do I have?

I would definitely recommend this solution to other users. Should you choose to use Cisco Sourcefire SNORT, I'd recommend that you get the help of a professional service for deployment.

Overall, on a scale from one to ten, I would give Cisco Sourcefire SNORT a rating of eight.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Buyer's Guide
Download our free Cisco Sourcefire SNORT Report and get advice and tips from experienced pros sharing their opinions.