Sharing rules 1.0

Sharing rules

Last updated 10 Nov 2026
On this page

Rules are plain JSON files with their own tests, so they travel well. Share them with your team, and with the community through the public Signal rule library.

Sharing inside your team

  • Keep your rules in a version-controlled folder, one file per topic.

  • Run signal rules -check -rules <dir> before every change is accepted.

  • Give the folder to every run: -rules \\server\signal$\rules. Pack it first if it names tools.

  • Signal Console's Rules page lists each rule file the hosts loaded, with its rules and the hosts that ran them. On a host whose run was not given the file, an imported rule is "not evaluated: rule file not given to the run".

The community rule library

Signal Rules is the public rule library on GitHub, where analysts share rules. Every rule in it is reviewed before it is merged, and every rule is free to use, under the MIT License, with any edition of Signal.

PowerShell Use the library 
git clone https://github.com/intrusion-academy/Signal-Rules.git
signal rules -check -rules .\Signal-Rules\rules
signal live -all -rules .\Signal-Rules\rules

Contributing a rule

  1. Write and test it

    Every key, the three texts (detail, impact, focus), at least one match and one look-alike test.

  2. Run the check

    signal rules -check -rules <your folder> must pass.

  3. Tune it

    Run it on clean hosts; add each false positive as a look-alike test.

  4. Open a pull request

    Say what it detects, why it is suspicious in itself, which hosts it was tuned on, and its false positives.

The review checklist

Check

Why

The check passes, with a look-alike test

The fidelity contract.

File names matched whole; paths anchored at the drive

Not fooled by a chosen name or path.

A raw log rule names its provider and event ID

One ID means different things from different providers.

The severity follows the criteria; a state is medium at most

Severities mean the same in every rule.

The texts say what happened, why it matters and what to do next

An analyst can act on the signal alone.

The rule is defensive: it detects, it never explains how to attack

The library is for defenders.

Tags are only what the evidence shows happened

A capability is not its use.