Skip to main content

A tool for downloading and archiving Snort and Suricata rules

Project description

Rule Downloader

This is a tool to aid in the downloading and archival of Snort rulesets. It also includes a tool, to itemize the changes from one version of a ruleset to another.


The ruledownloader is configured with an INI style file. The configuration file is passed to the ruledownloader with the -c command line switch. Alternatively, the ruledownloader will look for a file named ruledownloader.conf in the current directory and use that.

Example Configuration


# The dest-dir parameter tells ruledownloader where to place the
# files it downloads.  Subdirectories will be created under this
# directory for each conifgured ruleset.
dest-dir = .

# A ruleset configuration for a VRT subscription ruleset for Snort
[ruleset vrt-subscription-2904]

# Set to no to skip downloading this ruleset.
enabled = yes

# The URL this ruleset is found at.
url =<yourOinkCodeHere>

# Another ruleset configuration.
[ruleset et-open-290]
enabled = yes
url =

Directory Structure

Within the configured destination directory each policy will get its own directory based on on the name of the policy. That directory will contained timestamped directory names based on when the ruleset was downloaded. A symlink names 'latest' will point to the most recently downloader version of the ruleset.


Given the et-open-290 ruleset configuration above the following directory structure will be created.

./et-open-209/latest -> 201104070917

Reporting Changes

The rulechanges script can report the difference between an old and new version of a ruleset.


./ <oldRuleset.tar.gz> <newRuleset.tar.gz>

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ruledownloader-1.0.0.tar.gz (7.8 kB view hashes)

Uploaded Source

Built Distribution

ruledownloader-1.0.0-py3-none-any.whl (8.9 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page