Rulezet is an open-source web platform for sharing, evaluating, improving, and managing cybersecurity detection rules (YARA, Sigma, Suricata, Zeek, CRS, Nova, NSE, Wazuh, Elastic). It fosters collaboration among security professionals and enthusiasts to improve the quality and reliability of detection rules.

Rulezet is available as an online service at https://rulezet.org/

A Python virtual environment is strongly recommended.

# 1. Create a virtual environment
python3 -m venv env
source env/bin/activate

# 2. Install dependencies and initialize the database
python3 manage.py init

If you have already run init, this step is likely complete. If you need to initialize or re-initialize tables:

source env/bin/activate
python3 manage.py db-init

Note: This will display your temporary administrator credentials.

For local development:

python3 manage.py start-dev

The application runs on http://127.0.0.1:7009 by default.

After pulling the latest code changes, use the following command to synchronize your dependencies and database:

python3 manage.py update

Use the dedicated command to automate the backup, update, and service restart process:

python3 manage.py deploy

To view all available options at any time:

python3 manage.py --help

config.py selects the environment via the FLASKENV variable:

Secrets are stored in .env:

SECRET_KEY=your-secret-key
MAIL_PASSWORD=your-mail-password

# Re-create from scratch (drop + reinit)
python3 app.py -r

# Run migrations after model changes
flask db migrate -m "description"
flask db upgrade

# Backup / restore
./backup/scripts/backup_rulezet.sh
./backup/scripts/restore_rulezet.sh

# All tests
./launch.sh -t
# or:
FLASKENV=testing pytest tests

# Single file
FLASKENV=testing pytest tests/rules/test_rule.py
FLASKENV=testing pytest tests/rules/test_search_rules.py -k "test_name"

New formats can be added at any time without modifying the import pipeline — see the Contributing section.

• Create, edit, and delete detection rules
• Parse raw content to auto-extract metadata
• Import rules from GitHub repositories or ZIP archives
• Automatic syntax validation on import — invalid rules are quarantined and can be fixed
• Default TLP:CLEAR and PAP:CLEAR tags attached to every new rule automatically

• Rules Explorer with full-text search, format/tag/vulnerability filters, pagination
• Bundles Explorer — named collections of rules with a file-tree view
• Tag taxonomy — MISP-compatible tags with color, icon, and galaxy metadata
• Tag tooltips with description, visibility, and creation date

• Vote (up/down) on rules
• Favorite rules for personal collections
• Comment and discuss on rules and bundles
• Propose edits via PR-style change proposals (pending / approved / rejected)

• Import detection rules directly from public GitHub repositories
• Scheduled update checks to pull new rule versions
• Bulk GitHub source management with per-source rule listing
• Activity log links correctly strip .git suffixes when navigating to source details

• Full admin audit trail at /admin/logs
• Inline Public/Private visibility toggle per log entry (click the badge)
• Bulk visibility change (select rows → Set Public / Set Private)
• Bulk delete with background job
• Filters by action type, description search, and per-page count

• User management — promote/demote, view profiles, delete accounts
• Background jobs monitor and control panel (/jobs/list) with zombie detection
• Bulk tag rules with fine-grained filters via background jobs
• Manage rule formats — enable/disable detection format support
• Similarity engine — compute TF-IDF + fuzzy similarity scores between rules
• Reported rules management

• Consistent page header banner across all navigation pages (icon, title, accent bar)
• Full light / dark mode support with correct text contrast at all sizes
• Tag tooltips teleported to <body> — display correctly above carousels and overflow-hidden containers
• Smooth tooltip fade-in animation

Swagger UI is available at /api/.

Pass your API key in the X-API-KEY request header. Keys are generated on account creation and visible in your profile.

# Import rules from a GitHub repo
curl -X POST http://127.0.0.1:7009/api/rule/private/import_github \
  -H "X-API-KEY: your-key" \
  -d '{"url": "https://github.com/org/repo"}'

# Create a rule
curl -X POST http://127.0.0.1:7009/api/rule/private/create \
  -H "X-API-KEY: your-key" \
  -H "Content-Type: application/json" \
  -d '{"format": "yara", "title": "My Rule", "to_string": "rule My_Rule { ... }"}'

Homepage	Rule Detail	Invalid Rules

1. Create app/features/rule/rule_format/available_format/myformat_format.py
2. Subclass RuleType from rule_type_abstract.py
3. Implement all abstract methods: format, validate(), parse_metadata(), get_rule_files(), extract_rules_from_file(), find_rule_in_repo()
4. load_all_rule_formats() auto-discovers it via pkgutil.iter_modules — no further registration needed

We welcome contributions from the community:

• Submit pull requests for new features or bug fixes
• Report issues and suggest enhancements via GitHub Issues
• Help expand supported rule formats
• Improve documentation

This software is licensed under the GNU Affero General Public License version 3.

Copyright (C) 2025-2026 CIRCL - Computer Incident Response Center Luxembourg
Copyright (C) 2025-2026 Theo Geffe

Rulezet is co-funded by CIRCL and by the European Union under the FETTA (Federated European Team for Threat Analysis) project.

This project is inspired by Flask launchpad, extended with a modern UI, collaborative features, and full integration capabilities.