A centralized collection of security and logic rules for various platforms. This repository is designed as a resource library for workshops, CTFs, and technical training sessions, providing ready-to-import rules in multiple formats.
- YARA doc 4 rules and 1 bad rule
- SIGMA doc 3 rules and 1 bad rule
- SURICATA doc 3 rules
- CRS doc 3 rules
- ZEEK doc
- WAZUH doc 7 rules
- NOVA doc 8 rules
- NSE doc 2 rules
The rules found in this repository are gathered from various official open-source projects and community repositories on GitHub.
-
This project is not claiming ownership of these rules.
-
The intent is to provide a curated collection for training, not to copy or plagiarize original work.
-
All rules include references or headers pointing to their original authors and licenses (such as MIT, Apache 2.0, or GPL) whenever possible.
-
We encourage users to visit the original repositories listed in our documentation to support the creators.
This software is licensed under GNU Affero General Public License version 3
Copyright (C) 2025-2026 CIRCL - Computer Incident Response Center Luxembourg
Copyright (C) 2025-2026 Theo Geffe
Rulezet is co-funded by CIRCL and by the European Union under FETTA (Federated European Team for Threat Analysis) project.
