To download your OPEN ruleset use the following url format:

Suricata:

https://rules.emergingthreats.net/open/suricata-$version/emerging.rules.tar.gz

Snort:

https://rules.emergingthreats.net/open/snort-$version/emerging.rules.tar.gz

'$version' above is customer supplied. 

$version == the version of your Suricata or Snort IDS. 

Examples:

https://rules.emergingthreats.net/open/suricata-4.0.0/emerging.rules.tar.gz

https://rules.emergingthreats.net/open/snort-2.9.7.0/emerging.rules.tar.gz

Other platforms are available simply by replacing the platform with your desired ruleset. We currently support Suricata 2.0 and above and Snort 2.9.1 and above.

Rule Downloaders:

Suricata-Update:
Suricata-Update is the preferred method of managing Suricata rule files.  Please see instructions here:

https://github.com/OISF/suricata-update
Pulled Pork:
If you use Pulled Pork add this to your configuration:

rule_url=https://rules.emergingthreats.net/|emerging.rules.tar.gz|open

Pulled Pork also has to be told you are running Suricata by using -S

For example, if running Suricata 4.0.3:


$ ./pulledpork.pl -S suricata-4.0.3 -c /path/to/pulledpork.conf

Note that Pulled Pork < 0.7.1 doesn't work out of the box with Suricata ET rules.  Please use the latest version here if having issues:

https://github.com/shirkdog/pulledpork

Support:

Mailing lists:
Pro customers can also ask questions on our mailing list:

https://lists.emergingthreats.net/mailman/listinfo/
Twitter:
https://twitter.com/ET_Labs
IRC:
#emerging-threats on Freenode