Publish a rule in a few seconds, from scratch or from files you already have.

• Editor with syntax highlighting for every format, plus Markdown for the description
• Upload single files or a whole zip; import a Rulezet JSON export as is
• Every rule gets TLP:CLEAR and PAP:CLEAR by default, then any tag you add
• Each save is a new version, attributed to its author

Index a public repository once, then follow it.

• Imports every rule it recognises, with the source repository and path kept on the rule
• Checks the repository again later and shows what changed upstream
• Changes are reviewed and accepted one by one or in bulk — nothing is overwritten silently
• Synchronisation can be scheduled

Curated collections: a ready-to-deploy pack for a threat, a product or a team.

• Pick rules from the whole catalogue, of any format
• Arrange them in folders with the drag-and-drop structure editor
• Tags, description, comments and votes, like a rule
• Downloaded in one go, structure included

The public catalogue, mirrored to a Git repository.

• One folder per format, one file per rule
• Clone it, diff it, pull it from any tool that reads Git
• Updated automatically from the platform

Every format has its own parser; broken rules never pass unnoticed.

• Syntax checked on creation, edit and import, with the parser's error message
• Rules that fail are listed with their error until someone fixes them
• Fix a rule in place and validate it again in one step
• A quality score per rule: metadata, references, ATT&CK mapping…

The catalogue grows in coverage, not in copies.

• Content similarity computed between rules of the same format
• Each rule page lists its closest rules
• Admins review and merge duplicates across sources

Who changed what, when — for every rule and across the platform.

• Every version kept, compared side by side with a diff
• Metadata changes (tags, owner, description…) listed field by field
• Platform-wide activity log for administrators

What each format is for, who maintains it, and what Rulezet can turn it into.

• YARA, Sigma, Suricata, Zeek, Wazuh, KQL, Splunk, Elastic and more
• Official site and documentation of each format
• A graph of every export and conversion

Suggest a change to someone else's rule — like a pull request.

• The owner sees the exact diff and the reason for the change
• Discussion on the proposal before it is accepted or declined
• Accepted changes become a new version, credited to the proposer

Discuss a rule or a bundle where it lives.

• Threaded replies and reactions
• Report abusive content; moderation by administrators
• Every discussion of the platform in one hub

Imported a rule you actually wrote? Ask for it back.

• Request ownership of a rule from its page
• An administrator reviews the request and transfers the rule

Recognition for the people behind the rules.

• Public profiles with each member's rules and activity
• A leaderboard of contributions

Classify rules with the vocabularies the CTI community already uses.

• MISP taxonomies (TLP, PAP, …) and galaxies (threat actors, malware, tools…)
• Your own tags on top
• Filter and search the catalogue by any of them; tag thousands of rules in one job

See what is covered and where the gaps are.

• Rules mapped to ATT&CK techniques
• Heatmap of the community's coverage across the matrix
• Filter the catalogue by technique

A private space per investigation, and a home page made of the widgets you choose.

• Workspaces gather rules, bundles, notes, files and reference links
• Dashboard widgets arranged by drag and drop

"Tell me when…" — without checking the site every day.

• Alerts on new or changed rules matching your criteria
• In the app, or by email — instantly or as a daily / weekly digest
• Notifications for proposals, comments and requests on your rules

Every rule, in the shape your tools expect.

• Native file, Rulezet JSON, MISP object or event, STIX 2.1
• Velociraptor artifact for YARA and Sigma rules
• Sigma converted to Splunk, Elastic, Microsoft Sentinel, Sumo Logic, Google SecOps and Loki

From the rule page straight to your own tools.

• Push a rule to your MISP instance
• Deploy it to endpoints through your Velociraptor server

Run your own instance and stay in sync with others.

• Pull rules from a partner Rulezet instance
• Matched by UUID; skip existing rules or update them in place

Everything scriptable.

• Documented REST API (Swagger), authenticated with an API key
• Suricata rules served as a feed for suricata-update