Network detection, ready for Suricata.
A permissively-licensed open Suricata ruleset, but only the resalable BSD range, license-filtered, and validated on the real Suricata engine before delivery. Load it, it runs.
What we added recently
A living feed: here is the coverage added to it, dated.
- +67 règles
- +158 règles
- +320 règles
- +133 règles
- +19 règles
- +271 règles
Threats on the wire.
Command-and-control traffic, malware families, exfiltration.
Exploitation attempts against known vulnerabilities on the wire.
Port scans, recon tools, automated sweeping.
Web attacks, phishing kits, malicious redirects.
Trojans, botnets, adware/PUP.
Protocol anomalies, policy, suspicious traffic.
A permissively-licensed open Suricata ruleset (resalable BSD range; the GPLv2 range is excluded by the license filter) aggregated with complementary MIT sources, re-SIDed to avoid collisions. Copyrights and licenses retained in the pack.
License-filtered, engine-validated.
An open ruleset (BSD range) aggregated with MIT sources, only the resalable is shipped, GPLv2 excluded automatically (license filter).
Every delivery passes `suricata -T` on the engine, 0 rules that fail to load.
Rules + classification.config + a suricata.yaml example, plug it in.
The feed is signed; you verify its integrity before loading.
BSD allows redistribution to your clients, with attribution.
A single subscription, updated as campaigns emerge.
Which Suricata version?
The rules target Suricata 7.x and are validated on the latest official image. Load `rules/et-open-bsd.rules` via `rule-files` in your suricata.yaml (an example is provided).
What license, and can I resell / MSSP?
Only the BSD range of a permissively-licensed open Suricata ruleset, BSD permits commercial redistribution with copyright retained. The GPLv2 range is excluded automatically. The BSD text and upstream copyrights ship in the pack.
How is it different from ET Pro?
ET Pro (Proofpoint) is a separate per-sensor commercial feed. Here we package the BSD range of a permissively-licensed open Suricata ruleset, license-filtered, engine-validated, signed, under one flat-rate key, MSSP-redistributable.
Ready to watch your network?
Annual subscription. Instant key. Cancel anytime.