# Rule failed error

**URL:** <https://community.emergingthreats.net/t/rule-failed-error/2471>\
**Category:** Feedback & Support\
**Created:** [February 24, 2025, 6:56am UTC](https://community.emergingthreats.net/t/rule-failed-error/2471 "2025-02-24T06:56:58Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![bingohotdog](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/bingohotdog/32/42_2.png) [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\
**Post date:** [February 24, 2025, 6:58pm UTC](https://community.emergingthreats.net/t/rule-failed-error/2471/2 "2025-02-24T18:58:29Z")

</div>

Hi @EMTUser,

Thank you for reporting this. The error details mention “Unknown rule option: ‘byte\_math’” which indicates the Snort Engine running does not have this keyword available. You may want to compare your Snort Engine version against our supported Snort engines here ([Announcing legacy Snort version support conditions](https://community.emergingthreats.net/t/announcing-legacy-snort-version-support-conditions/1812)). Any version older than snort-2.9.13 is not supported by our rule set.

The rule’s logic relies on the available Snort byte\_math keyword and so, the rule will remain as is until further notice. At this time, disabling the rule maybe the suitable next step.

Cheers,  
🌭

---

_[View the full topic](https://community.emergingthreats.net/t/rule-failed-error/2471)._
