Commonly used Suricata rulesets

Any source that can be downloaded in the standard Suricata ruleset format, and does not require authentication, can be added to the list of sources. Here is a list of common Suricata ruleset sources. Just verify the URL, modify as needed, and add it to your list of sources.

  • Corelight Labs Suricata Rules: https://feed.corelight.com/rules/corelight.rules

  • ET/Open: https://rules.emergingthreats.net/open/suricata-6.0/emerging.rules.tar.gz

  • ET/Pro: https://rules.emergingthreatspro.com/<insert-et-pro-key-here>/suricata-7.0.3/etpro.rules.tar.gz

    This ruleset applies to Suricata 7.0.3, which was added in Corelight Sensor v27.11.

  • oisf/trafficid: https://openinfosecfoundation.org/rules/trafficid/trafficid.rules

  • ptresearch/attackdetection: https://raw.githubusercontent.com/ptresearch/AttackDetection/master/pt.rules.tar.gz

  • scwx/enhanced: https://ws.secureworks.com/ti/ruleset/<insert-secret-code-here>/Suricata_suricata-enhanced_latest.tgz

  • scwx/malware: https://ws.secureworks.com/ti/ruleset/<insert-secret-code-here>/Suricata_suricata-malware_latest.tgz

  • scwx/security: https://ws.secureworks.com/ti/ruleset/<insert-secret-code-here>/Suricata_suricata-security_latest.tgz

  • sslbl/ssl-fp-blacklist: https://sslbl.abuse.ch/blacklist/sslblacklist.rules

  • sslbl/js3-fingerprints: https://sslbl.abuse.ch/blacklist/ja3_fingerprints.rules

  • etnetera/aggressive: https://security.etnetera.cz/feeds/etn_aggressive.rules

  • tgreen/hunting: https://raw.githubusercontent.com/travisbgreen/hunting-rules/master/hunting.rules

  • malsilo: https://malsilo.gitlab.io/feeds/dumps/malsilo.rules.tar.gz