From 8c29c471b40a0a4e684b6c580a41ebb5479b1b6b Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Tue, 10 Mar 2026 10:39:16 -0300 Subject: [PATCH] userguide: add references to rules/README to docs To make it more visible/easier to find. --- .../rule-management/adding-your-own-rules.rst | 3 +++ doc/userguide/rules/meta.rst | 16 ++++++++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/doc/userguide/rule-management/adding-your-own-rules.rst b/doc/userguide/rule-management/adding-your-own-rules.rst index 2a2264b926..ef0229dd36 100644 --- a/doc/userguide/rule-management/adding-your-own-rules.rst +++ b/doc/userguide/rule-management/adding-your-own-rules.rst @@ -14,6 +14,9 @@ your console/terminal window: Write your rule, see :doc:`../rules/intro` and save it. +.. tip:: To ensure that there are no duplicated SIDs, check rule SID ranges read + more about `sid` at :ref:`suricata-rules-sids`. + Update the Suricata configuration file so your rule is included. Use one of the following examples: diff --git a/doc/userguide/rules/meta.rst b/doc/userguide/rules/meta.rst index 8777e00a88..8712f112ce 100644 --- a/doc/userguide/rules/meta.rst +++ b/doc/userguide/rules/meta.rst @@ -37,6 +37,8 @@ signature is emphasized below: .. note:: The following characters must be escaped inside the msg: ``;`` ``\`` ``"`` +.. _suricata-rules-sids: + sid (signature ID) ------------------ @@ -57,8 +59,8 @@ Example of sid in a signature: provided as the last keyword (or second-to-last if there is a ``rev``) of the signature. - There are reserved ranges of sids, the reservations are recorded - at https://sidallocation.org/ . + **There are reserved ranges of sids, the reservations are recorded + at https://sidallocation.org/ .** .. Note:: @@ -69,6 +71,16 @@ Example of sid in a signature: `_), it is advisable to opt for a completely unique ``sid`` altogether. +Suricata Engine Events Rules SID range +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Suricata provides signatures for engine events, bundled in the `rules` +folder, in the `suricata` directory/repository. +The full signature ID range for such rules is: 2200000 - 2299999. + +These sid ranges can be seen in the `rules README file +`_). + rev (revision) --------------