Licensing of third-party rules

[shohei]

Hello,

I understand that the “ET OPEN Rulesets” range from 2000000 to 2099999 is under the BSD license, and the range from 2100000 to 2103999 is under the GPL license.

Signature ID Allocation Ranges

For assignation of SIDs for both bespoke/curated daily signatures as well as our automated offerings which are based on third-party sources, the ET team follows the guidance built form a contribution of a number of Industry Partners and researchers. Details here: sidallocation.org Current ET-Relevant allocations: 2000000-2099999 Emerging Threats Open Rulesets 2100000-2103999 Forked ET Versions of the Original Snort GPL Signatures Originally sids 3464 and prior, forked to be maintained and co…

Then, what type of license do the third-party rules fall under? For example, the following rules:
https://rules.emergingthreats.net/open/suricata-7.0.3/rules/3coresec.rules
https://rules.emergingthreats.net/open/suricata-7.0.3/rules/ciarmy.rules

Thank you for your wonderful efforts.

[rgonzalez]

Thanks @shohei ! Those rules are part of ET Open for these purposes.

[shohei]

Thank you, @rgonzalez

Uhm…,
So “3coresec.rules”, “ciarmy.rules” and other third-party rules are the same as “ET Open”, are they under BSD license?

I found this post. I am wondering because in this case it is GPL 2.0.

Licensing: Is the Compromised-IPs list also 'Open'?

Hi. To me it’s not really clear if the compromised-ips.txt file below is in the Open-Package, or if it’s Pro. https://rules.emergingthreats.net/blockrules/compromised-ips.txt Is there any overview which list belongs to which ? What licensing model does it use ? Are they also all free to be used by companies ? Not for reselling, just to be used on a GW etc… KInd regards, Franzl

[rgonzalez]

Partners like 3CoreSec and Threatview.io are under agreement with Proofpoint to adopt their work specifically into ET Open. I’ll have to check on the legal specifics for CI-Army. If you have a specific use to propose I can ask our legal and that will definitely get you a better answer.