An objective 0-100 signal — how well documented, traceable and valid a rule is.
Separate from votes/favorites/comments, which only add a small capped bonus
on top and never affect the base score below.
20 ptsTraceability
- Has an original UUID (10)
- Git repository path known (5)
- Source repository known (5)
25 ptsAuthorship
- Meaningful description, 30+ characters (10)
- Author known (5) · License known (5)
- Says how it was written — human, AI or both, given by its owner or an admin in a review (5)
20 ptsMetadata
- Format-specific triage fields are present — e.g. Sigma documents references, known false-positive scenarios and a severity level; YARA has a rich meta block (10)
- Tags beyond the auto-attached defaults (5)
- ATT&CK mapping, for formats where it applies (5)
25 ptsValidity
- Passes format validation (15)
- No pending failed Git update (10)
25 ptsReview
- Looked at since creation: a review, or an edit well after creation (5)
- Approved in a review (any signed-in user), on the current version (10)
- Approved by two people (5)
- No change requested on the current version (5)
- Reviews are given with the Review button (Actions) and show in the rule's history; an edit makes them "older version" until reviewed again
25 ptsUniqueness & use
- Not a copy of an older rule — no rule created before it is 95%+ similar (10)
- Used in at least one bundle (5)
- Linked to a threat: a CVE or an ATT&CK technique (5)
- Has a published AI analysis report (5)
25 pts · if declaredField reports
- Someone declared a scope where it works (10)
- Works in two places or more (5)
- No scope saying it doesn't work (10)
- Not counted while nobody declared a scope
30 pts · if testedTesting
- Tested on sample sets, current version (5)
- Detects its samples (10)
- No false positive on clean samples (10)
- Ran without errors (5)
- Not counted at all while the rule was never tested — no penalty on an instance without the sandbox
15 pts · YARAExternal checks
- Compiles with YARA-X (5)
- Follows the CCCS YARA standard (5)
- No yaraQA issue — slow or weak strings / conditions (5)
- Only when the admin enables them; a check that cannot judge the rule alone (it uses another rule) is left out
Engagement boost (up to +10, shown separately)
Favorites, net votes and comments, scaled down — a popularity bonus on the displayed score, never part of the 0-100 base score above.
A criterion that doesn't apply (ATT&CK mapping on a YARA rule, testing on a rule never tested,
external checks outside YARA) is left out of that rule's total instead of counting against it:
the score is the share of the points that apply.
It is kept as is and recomputed only when something it reads changes (an edit, a tag, a
review, a scope, a test, a bundle…) — the next time the rule is opened —, by the
"Re-analyse now" button, or by the quality workflow task.
CIRCL