Community-Contributed Passive Scan Rules
How community-contributed passive scan rules are distributed and how to contribute or use your own rule sets.
Passive scan rules, both the defaults and community contributions, live in a single repository:
You do not need to install anything manually: when passive scanning is enabled (-P), Noir clones this repository to ~/.config/noir/passive_rules/ on first run and notifies you when it falls behind. Add --passive-scan-auto-update to pull the latest rules on startup, or run git pull in that directory yourself.
Contributing rules
To share a rule with the community, open a pull request against noir-passive-rules. Once merged, every Noir user picks it up through the normal rule update flow. See Passive Scan Rule for the rule format.
Using third-party or custom rule sets
To run a rule set from somewhere else (a private repository, a local directory), point Noir at it with --passive-scan-path:
noir scan /app -P --passive-scan-path ./my-rules/
This replaces the bundled rules for that run. The flag takes directories only (a single file is rejected) and can be repeated to load several of them. Alternatively, drop extra .yml/.yaml files into ~/.config/noir/passive_rules/. Everything in that directory is loaded recursively.