Your files stay on your device

Suricata rule validator

Check pasted or uploaded Suricata rules offline for header grammar (action, protocol, addresses, ports), option ordering and required metadata (sid, rev, msg), and duplicate SIDs across the set, then return each rule formatted with a one-line plain-language explanation.

Paste rules or add files, then press Validate rules.

What this validator checks, and what it does not
It reads one rule per line and checks the header grammar: action, protocol, addresses and ports with variables, CIDR, ranges, lists and negation, and the -> or <> direction. Then the option chain: required sid, rev and msg, numeric sid and rev with sid 0 called out as reserved, duplicate sids across the whole pasted set, content modifiers (nocase, depth, within and friends) that must follow a content, sticky buffers like http.uri that reset that context, unknown keywords, unknown classtypes and reference keys against the default classification.config and reference.config, and unknown flow words. Unknown keywords stay warnings on purpose: new Suricata releases and plugins add them. What it does not do: run rules against traffic, resolve your variables, or judge whether a rule is a good idea.OptionsValidate rules

More regex & cron tools

- Regex tester (/dev/regex-tester)
- JSON validator (/json/validator)
- Glob tester (/dev/glob-tester)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/suricata-rule-validator
Markdown version: https://nutter.tools/dev/suricata-rule-validator.md
Plain-text version: https://nutter.tools/dev/suricata-rule-validator.txt
Agent index: https://nutter.tools/llms.txt