Emerging Threats Open

Suricata evaluates signatures against live network traffic, not stored logs. There is no query and no index — packets and reassembled streams are matched as they pass the sensor, so a signature only ever sees what crossed the wire while it was loaded.

Emerging Threats Open is the free tier of a commercial feed. It is by a wide margin the largest source indexed here, and its size is not a proxy for its depth: much of the volume is indicator coverage rather than behavioural detection.

A signature is one line. A header — action, protocol, source and destination address/port with a direction arrow — then options in parentheses:

alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain
  peocity.com"; dns_query; content:"peocity.com"; depth:11; nocase;
  classtype:trojan-activity; sid:2016600; rev:3;)

The thing most often misread is the sticky buffer. dns.query, tls.sni, http.host, file_data and friends are not matches themselves — they select which part of the traffic every following content applies to, until the next buffer keyword. Read a rule's buffers first, then its contents; reading the contents alone tells you what strings matter but not where they have to appear.

Beyond single matches, flowbits and xbits carry state across signatures within a flow, which is how multi-stage detections are assembled — one signature sets a bit and stays silent, a later one fires only if the bit is set. threshold and detection_filter bound how often a signature can alert, and pcre carries the regex cases plain content cannot express.

The alert action, once every option in the parentheses is satisfied, subject to any threshold. Signatures carrying flowbits:noalert — 635 of them here — never alert at all; they exist purely to set state for other signatures, so finding one in a search result is not finding a detection.

Severity comes from classtype and, where ET supplies it, the signature_severity metadata field, which we treat as more authoritative because a person set it while classtype is structural.

Two site-wide defaults hide most of this source, both with an include link next to the count at the top of this page.

Deprecated. ET ships disabled signatures as commented-out #alert lines — roughly 19,000 of them, against about 51,000 enabled. We index them as deprecated rather than dropping them, because knowing a signature was retired is often the answer you came for.

Atomic IOC. A signature whose entire logic is one indicator in one buffer — a domain in a DNS query, an SNI value, a JA3 hash — is flagged and hidden from browse and coverage. Signatures with several contents, a pcre, flowbits, a threshold or any other compound condition are not flagged. The counts at the top of this page are current; use the include link to see them.

Eight IP-reputation feed files are not ingested at all — botcc.rules, drop.rules, tor.rules, dshield.rules and four others. Each is a third-party blocklist mechanically chunked into near-identical "group N" rules whose only content is an address set. The feed is the artifact worth citing, not its generated signatures.

• The atomic-IOC classifier exempts provider wildcards by looking for ET's own msg conventions (DYNAMIC_DNS, a leading *.). Structure cannot separate a whole dynamic-DNS provider from one attacker's domain — .njalla.net and .mipko.ru are byte-identical as rules — so this leans on upstream naming staying stable.
• ET Open lags ET Pro deliberately. Absence of coverage here is not absence of coverage from Emerging Threats.
• Both dns.query and the older dns_query spellings appear across the ruleset, along with http.host/http_host and similar pairs. They mean the same thing; searching for one will not find the other.