Suricata Rule Validator

Check a Suricata rule's header, options, ordering and required metadata, with a formatted version back and no traffic generated at any point.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop .rules files

Whole rulesets are fine - comments and continuation lines are handled. Checked in your browser.

Or paste rules, one per line

Check the header, the options, and the logic

A Suricata signature has a header and an option list. This validator checks the header's action, protocol, address and port expressions (variables, CIDR ranges, lists, port ranges and negation) and direction. It then walks the options in order, because in Suricata order carries meaning: nocase, depth and within modify the content before them, and a sticky buffer such as http.user_agent applies to everything after it. Errors are reported for:

a modifier with no content to modify;
a buffer that cannot exist for the rule's protocol;
hex content that is not hex;
an unescaped semicolon;
a flow that is both to_server and to_client;
a depth:0 that can never match.

Metadata that makes rules manageable

Every rule needs a unique sid, and duplicates across the pasted set are caught. It should carry a rev and a readable msg. Classtypes and reference types are checked against Suricata's default classification.config and reference.config, which our tests keep identical to the OISF originals. A custom classtype is a warning to define it, not an error.

Plain-language explanation

Each rule gets a one-line explanation, for example: "Alert on HTTP traffic from your network to outside networks; containing "ExampleAgent/1.0" in http.user_agent; on flows that are established, to_server". That is often the quickest way to notice a rule that does not say what its author meant.

Tested on real rulesets

More than a thousand Emerging Threats Open rules from the BSD-licensed range are part of our test suite. All of them parse with zero errors and no unknown keywords, so the validator does not cry wolf on real-world rules.

Frequently asked questions

Does this replace suricata -T?

No. Suricata's own test mode checks against your exact build, variables and configuration. This catches most mistakes earlier and explains them. Run suricata -T before deploying.

Why is an unknown keyword only a warning?

New Suricata versions add keywords, and plugins add more. An unknown keyword is flagged so you can check the spelling, but it is not assumed to be wrong.

Does it send traffic or touch my sensors?

No. Rules are text on this page. Nothing is generated, sent or deployed.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.