False Positive DeskBuild an appeal
VENDOR APPEAL GUIDE

Suricata false positive?
Here’s where to start.

Suricata is a rules engine. False-positive corrections should be addressed to the author of the matching rule; the official forum can help identify that owner.

Vendor guidance checkedSources reviewed: 2026-10-14Detection rules

Appeal contacts

Choose a channel for the type of detection you want reviewed. Contact availability and acceptance are controlled by the vendor.

How to request a review

Detection rules review

Suricata is a rules engine. False-positive corrections should be addressed to the author of the matching rule; the official forum can help identify that owner.

  1. Inspect the matching rule, including its SID, revision, message prefix and reference fields.
  2. For an Emerging Threats rule, use the Emerging Threats feedback portal; for another ruleset, contact that rule's maintainer.
  3. If ownership is unclear, ask in the Suricata forum and include the rule identifier, alert context and VirusTotal report link.
  • Suricata does not author every ruleset it runs. A forum response does not itself change a third-party signature.
  • Avoid posting private packet captures or credentials in a public forum.

Names you may see in a report

SuricataOpen Information Security Foundation

Aliases help locate the responsible vendor. Related products can use different submission channels; check the scope shown above.

Sources for this entry

“Guidance checked” means a public vendor source supports the route or instructions. We have not sent a test appeal or verified mailbox delivery. Read our methodology.

← Back to all vendors