{"id":44367675,"url":"https://github.com/ngsoti/rulezet-core","last_synced_at":"2026-02-11T19:04:15.981Z","repository":{"id":287847249,"uuid":"965942730","full_name":"ngsoti/rulezet-core","owner":"ngsoti","description":"Rulezet is an open-source web platform for sharing, evaluating, improving, and managing cybersecurity detection rules (YARA, Sigma, Suricata, etc). It aims to foster collaboration among professionals and enthusiasts to improve the quality and reliability of detection rules.","archived":false,"fork":false,"pushed_at":"2026-02-11T14:48:27.000Z","size":36065,"stargazers_count":42,"open_issues_count":12,"forks_count":4,"subscribers_count":9,"default_branch":"main","last_synced_at":"2026-02-11T16:21:49.754Z","etag":null,"topics":["cti","network-detection","network-security","threat-intelligence","yara"],"latest_commit_sha":null,"homepage":"https://rulezet.org/","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ngsoti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-04-14T06:48:13.000Z","updated_at":"2026-02-11T14:48:31.000Z","dependencies_parsed_at":null,"dependency_job_id":"bd6c8ad0-e3c7-4d67-87aa-94d0a3089845","html_url":"https://github.com/ngsoti/rulezet-core","commit_stats":null,"previous_names":["ngsoti/rulezet-core"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/ngsoti/rulezet-core","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ngsoti%2Frulezet-core","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ngsoti%2Frulezet-core/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ngsoti%2Frulezet-core/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ngsoti%2Frulezet-core/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ngsoti","download_url":"https://codeload.github.com/ngsoti/rulezet-core/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ngsoti%2Frulezet-core/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29341714,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-11T18:58:20.535Z","status":"ssl_error","status_checked_at":"2026-02-11T18:56:44.814Z","response_time":97,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cti","network-detection","network-security","threat-intelligence","yara"],"created_at":"2026-02-11T19:04:15.246Z","updated_at":"2026-02-11T19:04:15.976Z","avatar_url":"https://github.com/ngsoti.png","language":"HTML","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RULEZET ![Release](https://img.shields.io/badge/release-v1.2.0-blue)\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/ngsoti/rulezet-core/main/doc/logo_rulezet.png\" width=\"300\" alt=\"Rulezet logo\"\u003e\n\u003c/p\u003e\n\n## Community-Driven Detection Rules Platform\n\n**Rulezet** is an open-source web platform for sharing, evaluating, improving, and managing cybersecurity detection rules (YARA, Sigma, Suricata, etc). It aims to foster collaboration among professionals and enthusiasts to improve the quality and reliability of detection rules.\n\nRulezet is available as an online service at the following address [https://rulezet.org/](https://rulezet.org/)\n\n## Technology Stack\n\nThis project is built with:\n\n- **Flask** (Python)\n- **Vue.js 3**\n- **Flask Blueprints**\n- **Flask-Login** (Authentication)\n- **Flask-SQLAlchemy** (ORM)\n- **PostgreSQL** (Database)\n\n## Installation\n\n\u003e It is strongly recommended to use a **Python virtual environment**.\n\n```bash\n./install.sh\n```\n\n## First Connection\n\nAt the beginning, password and api Keys are generate to security reason\n\n```bash\n====================================================================================================\n✅ Admin account created successfully!\n🔑 API Key     : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ( Unique secret key )\n👤 Username    : admin@admin.admin\n🔐 Password    : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx   (⚠️ Change it after first login)\n====================================================================================================\n\n```\n\nYou should change the password after the first connection\n\n## Launching the Application\n\n```bash\n./launch.sh -l\n```\n\n## Features Overview\n\nThe platform includes a wide set of functionalities to manage and collaborate around detection rules:\n\n### User Management\n\n- Admin panel to **manage users**\n- **Favorite** rules for users\n\n### Rule Lifecycle\n\n- **Create**, **Edit**, and **Delete** rules\n- **Assign ownership** to rules\n\n### Search \u0026 Browse\n\n- Powerful **search bar** and rule **filtering**\n- **View detailed rule** and download or copy it\n\n### Community Collaboration\n\n- Propose **modifications** to existing rules via pull-request style edits\n- **Evaluate** rules to identify the most effective ones\n- **Comment** and **discuss** arround the rules\n\n### GitHub Integration\n\n- **Import detection rules directly** from public GitHub repositories\n\n### Rule Validity\n\n- Automatic **validation of imported rules**\n- Display and **manage invalid or malformed rules**\n\n### Light/Dark Mode\n\n- The **most** important feature to enhance user comfort while working in different environments 😉.\n\n## Rule's Formats\n\nNew rule formats may be added over time.  \nIf you want to propose a new format, feel free to open an **issue** on our [GitHub](https://github.com/ngsoti/rulezet-core.git).\n\nCurrently, the supported rule formats are:\n\n- yara\n- sigma\n- zeek\n- suricata\n- crs\n- nova\n- elastic\n- no format\n\n## UI Previews\n\n| Homepage                                                                                 | Rule Detail                                                                                         | Rule Management                                                                                    |\n| ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |\n| ![Home](https://raw.githubusercontent.com/ngsoti/rulezet-core/main/doc/rulezet_home.png) | ![Detail](https://raw.githubusercontent.com/ngsoti/rulezet-core/main/doc/rulezet_detail_readme.png) | ![Readme](https://raw.githubusercontent.com/ngsoti/rulezet-core/main/doc/rulezet_invalid_rule.png) |\n\n## API Access\n\nRULEZET provides a RESTful API to allow seamless integration and automation of key processes such as rule creation, importation, account management, and more.\n\nYou can access the interactive API documentation using the following URL:\n\n### Example Endpoints:\n\n- `http://127.0.0.1:7009/api/rule/doc/` – Manage detection rules (create, update, delete, import, etc.)\n- `http://127.0.0.1:7009/api/account/doc/` – Manage user accounts (registration, login, etc.)\n\n### Why Use the API?\n\n- Automate rule import/update from GitHub or local sources\n- Create and update rules programmatically\n- Manage user accounts and permissions via scripts or clients\n- Integrate RULEZET into your CI/CD or SOC pipeline\n\nWith this API, developers and analysts can save time, reduce errors, and streamline workflows — all while ensuring full compatibility with RULEZET's internal engine.\n\n\u003e Tip: Use tools like [cURL](https://curl.se/) to interact with the API and test endpoints easily.\n\n## Project Summary\n\nThis internship offers a unique opportunity to contribute to the development of a cutting-edge, open-source platform: a community-driven website designed for sharing, evaluating, and refining security detection rules. These rules, which are critical for identifying threats in cybersecurity, currently lack a central place for community validation. This project addresses that gap by creating a collaborative space where users can:\n\n- **Share Rules**: Contribute detection rules in various formats (YARA, Sigma, Suricata, and others), allowing for broad community access.\n- **Evaluate Rules**: Rate and comment on the effectiveness of rules, report false positives, and share practical experiences.\n- **Refine Rules**: Participate in the collaborative improvement of rules through feedback and proposed changes, enhancing their accuracy and reliability.\n- **Organize Rules**: Bundle rules into logical sets and classify them using tags and categories, improving searchability and usability.\n\nInterns will play a key role in developing the website’s features and functionalities. This will involve implementing core features, exploring integrations with other security tools such as MISP and Suricata, and assisting in the development of a security rule data model for a standardized format to facilitate easy exchange. Interns will gain hands-on experience in open-source software development, web development, and practical cybersecurity applications.\n\nThis project offers a chance to make a real-world impact by improving the way security professionals interact with essential threat detection information. You will gain exposure to web development, APIs, data modeling, and security knowledge.\n\n---\n\n## Original Inspiration\n\nThis project is inspired by [Ptit Crolle](https://github.com/DavidCruciani/ptit-crolle), and takes it further with a modern UI, collaborative features, and integration capabilities.\n\n## Contributing\n\nWe welcome contributions from the community. You can:\n\n- Submit pull requests for new features or bug fixes\n- Suggest enhancements via GitHub Issues\n- Help expand supported rule formats\n\n## License\n\nThis software is licensed under [GNU Affero General Public License version 3](http://www.gnu.org/licenses/agpl-3.0.html)\n\n```\nCopyright (C) 2025-2026 CIRCL - Computer Incident Response Center Luxembourg\nCopyright (C) 2025-2026 Theo Geffe\n```\n\n## Funding\n\nRulezet is co-funded by [CIRCL](https://www.circl.lu/) and by the European Union under [FETTA](https://www.circl.lu/pub/press/20240131/) (Federated European Team for Threat Analysis) project.\n\n![EU logo](https://www.vulnerability-lookup.org/images/eu-funded.jpg)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fngsoti%2Frulezet-core","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fngsoti%2Frulezet-core","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fngsoti%2Frulezet-core/lists"}