Messages

Code Select Expand

[quote author=RayonRa link=msg=230319 date=1740344827]
Hi,
i use ET Pro Telemetry.
Watching around i didn't see log from Dshield and 3coresec.
[/quote]

3coresec recently discontinued the Blacklist from which their ET Open ruleset was built.  As such we have discontinued offering that for download.

The other open source sets included in ET Open are functioning normally:

https://rules.emergingthreatspro.com/open/suricata-7.0.3/rules/drop.rules
https://rules.emergingthreatspro.com/open/suricata-7.0.3/rules/dshield.rules
https://rules.emergingthreatspro.com/open/suricata-7.0.3/rules/compromised-ips.txt

We're looking at the 502 errors - this is not a sensor disabling issue.  Resource-wise our internal monitoring shows the server healthy and responsive.  Are you still having this problem?

please let us know at support(at)emergingthreats.net if you have further problems. 

I have the same problem
Is this possibly the answer to the problem?

https://community.emergingthreats.net/t/etpro-telemetry-edition/2355

"For sensors opting-in to sending Proofpoint/ET telemetry so they can receive ETPRO telemetry edition those sensors must have sent event telemetry back to Proofpoint/ET within the last 5 days.

Sensors may go dormant during that period (no heartbeat sent in the last day) and still receive ETPRO Telemetry Edition, but if no events are received for 5 days the Telemetry Edition rule delivery will be disabled and that sensor will simply receive that day's ET Open rules.

That disabling will transition back to active delivery upon resumption of heartbeat and telemetry delivery back to Proofpoint/ET.

Sensors are reviewed as to state every 24 hours."

Greetings - we've modified the token code to re-enable sensors which had been disabled in this period as well as open up the window that's examined to determine whether a sensor is still sending us data (or not). Apologies for the disruption. We'll get some documentation out clarifying our position on telemetry reception and periodicy soon.--ET Team

Greetings.  Disabled sensors should now be re-enabled.  We've modified the token code to increase the size of the window that's examined to determine whether a sensor is still sending us data or not. Apologies for any disruption. We'll get some documentation out clarifying our position on telemetry reception and periodicy soon.--ET Team

Greetings all - We've modified the token code to re-enable sensors which had been disabled in this period as well as open up the window that's examined to determine whether a sensor is still sending us data (or not). Apologies for the disruption. We'll get some documentation out clarifying our position on telemetry reception and periodicy soon.--ET Team