# Empty rules with ET Pro Telemetry Opnsense **URL:** \ **Category:** Feedback & Support\ **Created:** [March 2, 2025, 5:16pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490 "2025-03-02T17:16:11Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 2, 2025, 5:16pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/1 "2025-03-02T17:16:11Z")
Hello: I am running OPNsense 25.1.2 with suricata 7.0.8\_2. I installed the ET Pro Telemetry plugin and input my token. When I selected and downloaded the rules I found that some of the rulesets were empty ( Et/compromised, Et/drop, and Et/dshield for sure. I can’t remember if there were any others. I tried to redownload the rules and remove and reinstall the ET Pro Telemetry plugin but those rules remained empty. Has anyone else had this problem and is there a fix for this. ---
**Author:** ![RayonRa](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@RayonRa](https://community.emergingthreats.net/u/RayonRa)\ **Post date:** [March 2, 2025, 6:30pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/2 "2025-03-02T18:30:13Z")
Hi, Same issue here. OPNsense with ETPro-Telemetry and some ruleset are empty. Seems that the issue starts (for me) 2-3 weeks ago. The empty ruleset appear in this way: Example: /usr/local/etc/suricata/opnsense.rules/dshield.rules ```auto #@opnsense_download_hash:5808b7725cadca60de2ba2de7b86c548 ``` and nothing else. You can also check my post on OPNsense forum. [https://forum.opnsense.org/index.php?topic=46015.0](https://forum.opnsense.org/index.php?topic=46015.0) ---
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 2, 2025, 8:43pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/3 "2025-03-02T20:43:26Z")
Yes. I read your post on the opnsense forum and replied to it. I checked after reading your post and found the same. I had never seen that before when I was using ETPro Telemetry. I’m surprised that nobody else has chimed in on this. ---
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [March 3, 2025, 9:28pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/4 "2025-03-03T21:28:43Z")
Greetings all - we’ll take a look here. These open source rules are created programmatically from outside sources. We’re investigating. ---
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 3, 2025, 9:56pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/5 "2025-03-03T21:56:27Z")
Thanks for the reply. Will be awaiting your response when you have more information. ---
**Author:** ![RayonRa](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@RayonRa](https://community.emergingthreats.net/u/RayonRa)\ **Post date:** [March 13, 2025, 6:12pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/6 "2025-03-13T18:12:08Z")
Hi @rgonzalez , any news about this issue? Thanks. Regards. ---
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [March 13, 2025, 7:30pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/7 "2025-03-13T19:30:27Z")
We’re still investigating as there doesn’t seem to be anything comprehensively ‘wrong’ on our end. Can you detail the ET Open rulesets which are arriving blank? ---
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 13, 2025, 11:37pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/8 "2025-03-13T23:37:46Z")
Thanks for getting back. Its not the ET Open rules. They are all fine. Its the ET Pro Telemetry rulesets. ET compromised, ET drop, ET dshield for sure. I don’t remember if there were any others. ---
**Author:** ![RayonRa](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@RayonRa](https://community.emergingthreats.net/u/RayonRa)\ **Post date:** [March 15, 2025, 8:21pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/9 "2025-03-15T20:21:20Z")
@rgonzalez , i can confirm that ET compromised, ET drop, ET dshield are empty. ---
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 19, 2025, 11:41pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/10 "2025-03-19T23:41:26Z")
Is any news on this issue yet. ---
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [March 20, 2025, 5:53pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/11 "2025-03-20T17:53:31Z")
What version of suricata are you running? We’re not seeing where our rule curation process should push out the programmatic ET Open rules from third parties (drop.rules, dshield.rules, ciarmy.rules) in our analysis. ---
**Author:** ![RayonRa](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@RayonRa](https://community.emergingthreats.net/u/RayonRa)\ **Post date:** [March 20, 2025, 7:45pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/12 "2025-03-20T19:45:03Z")
Suricata 7.0.8\_2 I don’t think that the problem is suricata. IMPORTANT NOTE: I decide to try to understand the problem by myself: I used curl command: ```auto curl -H "Authorization: Bearer " https://opnsense.emergingthreats.net/api/v1/ruleset/engine/suricata/5 --output rules.tar.gz ``` I extracted the rules. AND ```auto -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 botcc.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 ciarmy.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 3,2K 19 mar 05.10 classification.config -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 compromised.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 drop.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 dshield.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-3coresec.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-activex.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 351K 19 mar 05.16 emerging-adware_pup.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 74K 19 mar 05.16 emerging-attack_response.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-botcc_portgrouped.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 7,6K 19 mar 05.16 emerging-chat.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 14K 19 mar 05.16 emerging-coinminer.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 9,0K 19 mar 05.16 emerging-current_events.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 46K 19 mar 05.16 emerging-deleted.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 9,4K 19 mar 05.16 emerging-dns.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 13K 19 mar 05.16 emerging-dos.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 489K 19 mar 05.16 emerging-exploit_kit.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 293K 19 mar 05.16 emerging-exploit.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-ftp.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 6,9K 19 mar 05.16 emerging-games.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 113K 19 mar 05.16 emerging-hunting.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-icmp_info.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-icmp.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-imap.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-inappropriate.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 2,2M 19 mar 05.16 emerging-info.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 3,3K 19 mar 05.16 emerging-ja3.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 6,9M 19 mar 05.16 emerging-malware.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-misc.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 612K 19 mar 05.16 emerging-mobile_malware.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-netbios.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 16K 19 mar 05.16 emerging-p2p.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 581K 19 mar 05.16 emerging-phishing.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 419K 19 mar 05.16 emerging-policy.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-pop3.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-rpc.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 4,8K 19 mar 05.16 emerging-scada.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-scada_special.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 33K 19 mar 05.16 emerging-scan.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-shellcode.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 3,0K 19 mar 05.16 emerging-smtp.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 4,7K 19 mar 05.16 emerging-snmp.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-sql.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-telnet.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-tftp.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 30K 19 mar 05.16 emerging-user_agents.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 4,4K 19 mar 05.16 emerging-voip.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 43K 19 mar 05.16 emerging-web_client.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 40K 19 mar 05.16 emerging-web_server.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 225K 19 mar 05.16 emerging-web_specific_apps.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 5,7K 19 mar 05.16 emerging-worm.rules -rw-r--r-- 1 l0rdg3x l0rdg3x 173K 19 mar 05.16 telemetry_sids.txt -rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 tor.rules ``` AND ET compromised, ET drop, ET dshield are completely empty. So please fix. The rules are empty already in the tar.gz on your server. Thanks! PS: @Freewheelin if you can do the same test, please. Thanks! Also other rules are empty. Need to compare with ET Open. ---
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 20, 2025, 8:13pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/13 "2025-03-20T20:13:52Z")
I’m running opnsense 25.1.3 and suricata 7.0.8\_2. I did the same test and got the exact output from the extracted rules that you have with the same empty rulesets as you. ---
**Author:** ![pschroeder](https://avatars.discourse-cdn.com/v4/letter/p/c89c15/32.png) [@pschroeder](https://community.emergingthreats.net/u/pschroeder)\ **Post date:** [March 21, 2025, 7:11pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/14 "2025-03-21T19:11:59Z")
Hello all, I’m a member of the team that handles delivery of the ET Telemetry ruleset. The empty files have been a part of the ET Telemetry ruleset for quite a while, and are a result of the curation process. The current curation process creates a file for every possible category, but during curation it is likely that some categories remain empty. To verify this, I looked at archived Telemetry rulesets going back at least one year, and I see similar empty rule files. So this is not a new phenomenon. I can understand how, as an end user, this seems strange or problematic, but this is not an error/problem with the ruleset. ---
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 22, 2025, 12:13am UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/15 "2025-03-22T00:13:48Z")
So why would those rulesets remain empty in ET Pro Telemetry but yet the categories still exist, when they are available ET Open. It doesn’t make sense to me. ---
**Author:** ![RayonRa](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@RayonRa](https://community.emergingthreats.net/u/RayonRa)\ **Post date:** [March 23, 2025, 6:27pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/16 "2025-03-23T18:27:42Z")
In this case on OPNsense (and probably all platform), all the empty rulesets of ETPro Telemetry overwrite ET Open rulesets, obtaining empty rulesets. Which is worse than having the only ETOpen. Seriusly. This don’t make any sense. In this case delete the ETPro version of those empty rulesets in OPNsense plugin, so OPNsense downloads the ETOpen version. Or (maybe better) copy the content of ETOpen in this ETPro rulesets?!? Thanks ---
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 23, 2025, 6:55pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/17 "2025-03-23T18:55:38Z")
RayonRa: In plugins you can install os-intrusion-detection-content-et-open DS Proofpoint full ET open ruleset complementary subset for ET Pro Telemetry edition on top of the ET Telemetry Pro to get the ET Open rules back and use them for the ones that are empty in the ET Pro. Not the best solution, but that is what I did. They must have known some of the rulesets are empty or why else would they include an ET Open complementary subset for ET Pro. ---
**Author:** ![RayonRa](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@RayonRa](https://community.emergingthreats.net/u/RayonRa)\ **Post date:** [March 23, 2025, 7:27pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/18 "2025-03-23T19:27:54Z")
> [@Freewheelin](#): > > Not the best solution, but that is what I did And for someone that can’t or don’t know how to check if a ruleset is empty or not (via SSH for example). How can choose an ETOpen ruleset over ETPro one? ---
**Author:** ![Freewheelin](https://avatars.discourse-cdn.com/v4/letter/f/ecc23a/32.png) [@Freewheelin](https://community.emergingthreats.net/u/Freewheelin)\ **Post date:** [March 23, 2025, 7:59pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/19 "2025-03-23T19:59:23Z")
You will see both sets in intrusion detection downloads. Choose the ET pro sets that you want to use that yo know have rules in them and then choose the ET Open sets that are missing from Pro, Such as compromised and drop eg. ---
**Author:** ![RayonRa](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@RayonRa](https://community.emergingthreats.net/u/RayonRa)\ **Post date:** [March 23, 2025, 8:46pm UTC](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490/20 "2025-03-23T20:46:26Z")
> [@Freewheelin](#): > > that yo know have rules in them Yeah, i know because i see in ssh what rulesets are empty. How about people that don’t know that? I’m looking for a solution for everyone. Not only for me. Thanks. [Next page](https://community.emergingthreats.net/t/empty-rules-with-et-pro-telemetry-opnsense/2490.md?page=2)