# Error when running updata suricata rule script **URL:** \ **Category:** Rules\ **Created:** [March 25, 2025, 10:25am UTC](https://forum.suricata.io/t/error-when-running-updata-suricata-rule-script/5521 "2025-03-25T10:25:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![kajamuhaiyadeen](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/kajamuhaiyadeen/32/3541_2.png) [@kajamuhaiyadeen](https://forum.suricata.io/u/kajamuhaiyadeen)\ **Post date:** [March 25, 2025, 10:25am UTC](https://forum.suricata.io/t/error-when-running-updata-suricata-rule-script/5521/1 "2025-03-25T10:25:31Z")
Hi Team, When I am running the updatesuricata.sh script getting the following error: need your expertise to troubleshoot and fix it. 25/3/2025 – 06:18:08 - – [ERRCODE: SC\_ERR\_RULE\_KEYWORD\_UNKNOWN(102)] - unknown rule keyword ‘http.response\_header’. 25/3/2025 – 06:18:08 - – [ERRCODE: SC\_ERR\_INVALID\_SIGNATURE(39)] - error parsing signature “alert http $HOME\_NET any → any any (msg:“TGI HUNT Malicious Chunk-Proxy Webshell Artifacts in HTTP Response”; flow:established,to\_client; http.response\_header; content:“status|3a 20|”; pcre:”/^(?:close|successfully)/R"; threshold:type limit, track by\_src, seconds 60, count 1; reference:url,[TGI HUNT Ruleset Update](http://travisgreen.net/updates/20240123); classtype:bad-unknown; sid:2610869; rev:1;)" from file /var/lib/suricata/rules/suricata.rules at line 779 25/3/2025 – 06:18:10 - – [ERRCODE: SC\_ERR\_NO\_RULES\_LOADED(43)] - Loading signatures failed. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [March 26, 2025, 12:54pm UTC](https://forum.suricata.io/t/error-when-running-updata-suricata-rule-script/5521/2 "2025-03-26T12:54:43Z")
> [@kajamuhaiyadeen](#): > > alert http $HOME\_NET any → any any (msg:“TGI HUNT Malicious Chunk-Proxy Webshell Artifacts in HTTP Response”; flow:established,to\_client; http.response\_header; content:“status|3a 20|”; pcre:”/^(?:close|successfully)/R"; threshold:type limit, track by\_src, seconds 60, count 1; reference:url,[TGI HUNT Ruleset Update](http://travisgreen.net/updates/20240123); classtype:bad-unknown; sid:2610869; rev:1;) What version of Suricata are you running? `http.response_header` is a valid keyword. I validated that rule is fine using Suricata 7 and our Suricata 8 preview. ---
**Author:** ![kajamuhaiyadeen](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/kajamuhaiyadeen/32/3541_2.png) [@kajamuhaiyadeen](https://forum.suricata.io/u/kajamuhaiyadeen)\ **Post date:** [March 27, 2025, 5:16am UTC](https://forum.suricata.io/t/error-when-running-updata-suricata-rule-script/5521/3 "2025-03-27T05:16:14Z")
Using Suricata 6.0.12 when I am running updatesuricata script its trying update this rule from external threat feeds and failing with this error. ---
**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\ **Post date:** [March 27, 2025, 6:01am UTC](https://forum.suricata.io/t/error-when-running-updata-suricata-rule-script/5521/4 "2025-03-27T06:01:35Z")
The error seems legit. `http.response_header` was added in 7. Please note that Suricata 6 is EOL. It is recommended to upgrade to the latest stable Suricata 7.0.10. > its trying update this rule from external threat feeds and failing with this error. You should try and get version specific rules or modify them as per the supported features in a specific version. However, we won’t be able to provide support for EOL versions of Suricata. ---
**Author:** ![kajamuhaiyadeen](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/kajamuhaiyadeen/32/3541_2.png) [@kajamuhaiyadeen](https://forum.suricata.io/u/kajamuhaiyadeen)\ **Post date:** [March 27, 2025, 9:48am UTC](https://forum.suricata.io/t/error-when-running-updata-suricata-rule-script/5521/5 "2025-03-27T09:48:50Z")
Are there any workarounds available to address this issue in Suricata 6? As our critical systems rely on it, we urgently need a temporary solution while working on upgrading to Suricata 7.0.x. ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [March 27, 2025, 10:40am UTC](https://forum.suricata.io/t/error-when-running-updata-suricata-rule-script/5521/6 "2025-03-27T10:40:38Z")
> [@kajamuhaiyadeen](#): > > As our critical systems rely on it, we urgently need a temporary solution while working on upgrading to Suricata 7.0.x. Since Suricata 6 is EOL it also does not receive any security updates anymore, so for a critical system it is even more important to be at a supported version ASAP. Shivani mentioned a potential way to solve this, you need to fetch the rules for the old version or modify those rules. But not all providers for signatures will support EOL versions as well. ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [March 27, 2025, 1:14pm UTC](https://forum.suricata.io/t/error-when-running-updata-suricata-rule-script/5521/7 "2025-03-27T13:14:14Z")
> [@kajamuhaiyadeen](#): > > Are there any workarounds available to address this issue in Suricata 6? As our critical systems rely on it, we urgently need a temporary solution while working on upgrading to Suricata 7.0.x. The best workaround in this case is to disable rulesets causing the issues as they are most likely wirrten to a newer version of Suricata. Or if your script allows, just disable the signature IDs that are failing to load.