[[ fm.text ]]
Click here
[[ bundle.name ]]
[[ releasesSummary.releases[0].version ]]
+[[ releasesSummary.latest_changes.total ]]
Verified
[[ bundle.access ? 'Public' : 'Private' ]]
Owner
Admin access
Written with:
![]()
[[ w.label.charAt(0) ]]
[[ w.label ]]
[[ w.model ]]
Export to another Rulezet
The file [[ exportFileName ]] is downloading. It holds every rule with its metadata
(author, license, version, UUID, tags, ATT&CK, how it was written), the folders and the files of the bundle.
- On the other Rulezet, sign in as an admin.
- Open Create bundle and its Import from JSON section.
- Choose the file: a preview shows the rules it creates, updates or finds already there.
- Confirm — the bundle and its rules are created there, owned by you.
Rules already on that instance (same UUID) are reused, not duplicated. ATT&CK techniques attach when that instance has the MITRE data.
[[ stat.value ]]
[[ stat.label ]]
[[ stat.sub ]]
Loading…
Fork “[[ bundle.name ]]”
A fork is your own copy of this bundle, linked to it: change it as you like, then propose your changes back with a merge request.
Leave the name empty to keep “[[ bundle.name ]] (fork)”.
[[ forkInfo.why_not_fork || 'You can\'t fork this bundle.' ]]
Existing forks
No fork yet.
[[ f.name ]]
[[ f.user_id === CURRENT_USER_ID ? 'Yours' : (f.owner || 'Someone') ]] · [[ f.updated_at || f.created_at ]] · private
Open
+ [[ forkHidden ]] private fork[[ forkHidden > 1 ? 's' : '' ]] you can't see
Tags in [[ viewRelease.version ]]
[[ t ]]
No tags
Security identifiers in [[ viewRelease.version ]]
[[ v ]]
None
Bundle Content
Included Security Rules
[[ totalRules ]] rule[[ totalRules === 1 ? '' : 's' ]] in this bundle
Loading release…
Structure
[[ allFiles.length ]] file[[ allFiles.length === 1 ? '' : 's' ]] · folder layout as downloaded
[[ releaseSwitching ? 'Loading release…' : 'Loading structure…' ]]
([[ bundle.number_of_rules ]] rules — this can take a moment)
This bundle has no structure yet.
Files & Documents
Everything that isn't a rule — READMEs, notes, IOCs, configs
Handle with care.
files and rules in a bundle are user-submitted and are not reviewed by Rulezet. They may contain malicious code, links or scripts — inspect them before opening, running or deploying, preferably in an isolated environment.
ATT&CK Coverage
[[ attackStats.covered_tactics ]]/[[ attackStats.total_tactics ]] tactics covered by the bundle's rules
MITRE ATT&CK techniques referenced by the bundle's rules
Releases
Frozen versions you can deploy, reference and compare — later edits never change a published release
Health check
What a SOC would hit when deploying this bundle — syntax, ID collisions, missing dependencies, TLP/PAP, quality
Notes & known issues
What the community found when using this bundle — read before deploying
AI Analysis
Rulezy's review of the whole bundle — AI-generated, read it with a critical eye
Forks & merge requests
Copies of this bundle and the changes they propose
History
Every change to the bundle — details, visibility, tags, rules, files and folders
MISP Event
The bundle as a MISP event — graph and raw JSON
Building the MISP event…
Could not build the MISP event
[[ mispStats.info ]]
[[ mispStats.objects ]] object[[ mispStats.objects === 1 ? '' : 's' ]]
[[ mispStats.attributes ]] attribute[[ mispStats.attributes === 1 ? '' : 's' ]]
[[ mispStats.tags ]] tag[[ mispStats.tags === 1 ? '' : 's' ]]
[[ mispStats.uuid ]]
The graph could not be drawn — the JSON view is still available.
[[ historyDiff.title || 'Description changes' ]]
Community Discussion
Fetching bundle details...