AIProtection replacement ? Or how to manage it ?

[BobLeMarrant]

Hello,

Question about AiProtection and especially the IPS part.
Not being able to add an exception yourself is a real shame, and a blocker in some cases.
Since I don't want to disable AiProtection or just the IPS part for my entire network, I'm wondering...
How do you do on your side?

We agree that it's not possible to manage this via SSH (with more settings...?).

Is there an alternative to the AiProtection module?
Suricata could be an alternative, but no longer seems to be maintained...
Any clues?

Thanks
BLM

 

[drinkingbird]

Hello,

Question about AiProtection and especially the IPS part.
Not being able to add an exception yourself is a real shame, and a blocker in some cases.
Since I don't want to disable AiProtection or just the IPS part for my entire network, I'm wondering...
How do you do on your side?

We agree that it's not possible to manage this via SSH (with more settings...?).

Is there an alternative to the AiProtection module?
Suricata could be an alternative, but no longer seems to be maintained...
Any clues?

Thanks
BLM

You can't customize it at all, it is either on or off. Client side security suite is probably your best alternative. There are also plenty of addons for Merlin that you can use that use DNS filtering or IP blacklists. Not quite the same as signature based though.

You can leave aiprotection on and disable malicious site blocking, so you still receive some of the benefits, but that's a pretty big one to remove without having something else in place. Bear in mind most browsers have some form built in, and most antivirus/security will add their own as well.

 

[BobLeMarrant]

You can't customize it at all, it is either on or off. Client side security suite is probably your best alternative. There are also plenty of addons for Merlin that you can use that use DNS filtering or IP blacklists. Not quite the same as signature based though.

You can leave aiprotection on and disable malicious site blocking, so you still receive some of the benefits, but that's a pretty big one to remove without having something else in place. Bear in mind most browsers have some form built in, and most antivirus/security will add their own as well.

Hi
Thanks for your feedback
In fact, I'm not worried about Windows/Linux/BSD clients and even Android smartphones - tablets.

It's more the rest, "without administration", the iOT and connected objects part.
Like many people, I have many constantly connected devices. It's for these that I don't necessarily want to deactivate AiProtection without alternative.
Honestly, I don't know what to replace it with.

NB: I already have Skynet, as a complement.

 

[fanasus]

hello,
what are the URLs to block in "AdguardHome" for example, to avoid collecting information of "AI Protection" de trend micro, please, thanks !

 

[Tech9]

to avoid collecting information of "AI Protection"

There is no point doing that. If you block Trend Micro servers all related Trend Micro services will stop working. If you don't want to share information with Trend Micro just withdraw the data sharing agreement in Administration, Privacy.