The open source security intelligence repository for detection rules.
Share, evaluate, test and improve detection rules — together.
rulezet.org · API · Source code · Report an issue
Rulezet is an open source platform where security teams and researchers publish, review and maintain cybersecurity detection rules. Every rule is parsed and checked when it is added, linked to the vulnerabilities (CVE) and MITRE ATT&CK techniques it covers, scored for quality, and improved by the community through votes, comments and edit proposals.
Rulezet is available as a public service at rulezet.org, and can be self-hosted. Instances can synchronise with each other through connectors.
Supported formats — YARA, Sigma, Suricata, Zeek, OWASP CRS, Nova, NSE, Wazuh, Elastic, and more: new formats plug into the platform without changing its import pipeline.
| Find | Search every rule by format, tag, CVE or ATT&CK technique; follow a vulnerability or a technique on its own page with every rule that covers it. |
| Write | Create rules in a dedicated editor with completion, live validation and dependency handling, or import them from GitHub repositories, files and JSON. |
| Test | Run rules on sample sets in a sandbox before publishing: detections, misses and false positives, kept for every version of a rule. |
| Share | Group rules into bundles, export them (files, JSON, MISP, STIX) and keep mirrors of the whole collection on GitHub. |
| Improve | Vote, comment and propose edits; every rule keeps its full history and a quality score. |
| Repository | Description | |
|---|---|---|
 |
rulezet-core | The Rulezet platform: web application, REST API, connectors and administration. |
 |
rulezet-editor | Standalone, pluggable editor for detection rules (YARA first; Sigma, Suricata and more to come). |
 |
rulezet-tester | Runs detection rules on sample sets in a sandbox: detections, misses, false positives. |
 |
rulezet-cast | Parser and normalizer that converts multi-format detection signatures into structured JSON. |
 |
rulezet-validation | Scans Rulezet's YARA rules against known-clean binaries and quarantines the rules that fire on them. |
 |
rulezet-rulesets | Read-only mirror of every rule published on the official instance. |
 |
rulezet-sample-rules | Ready-to-import rules in multiple formats for workshops, CTFs and training sessions. |
 |
rulezet-workshop | Workshop materials: slide deck, hands-on exercises and demo resources. |
 |
rulezet-scripts | Scripts to work with rulezet.org from the command line. |
 |
rulezet-ai-skill | AI agent skill to develop on Rulezet: architecture, conventions, permissions, settings, tests and workflow. |
- Use it — browse and download rules on rulezet.org, or query the API.
- Contribute rules — publish your own rules or import your repositories; propose fixes to existing ones.
- Contribute code — pull requests are welcome on every repository; new rule formats are a good place to start.
- Report — bugs and ideas go to the issue tracker of the repository concerned.
Rulezet is developed by CIRCL (Computer Incident Response Center Luxembourg) and co-funded by the European Union under the FETTA project (Federated European Team for Threat Analysis).
