# Removing icons from EmergingThreats rules

**URL:** <https://forum.suricata.io/t/removing-icons-from-emergingthreats-rules/6106>\
**Category:** Uncategorized\
**Created:** [November 12, 2025, 8:47am UTC](https://forum.suricata.io/t/removing-icons-from-emergingthreats-rules/6106 "2025-11-12T08:47:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![clopmz](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@clopmz](https://forum.suricata.io/u/clopmz)\
**Post date:** [November 12, 2025, 8:47am UTC](https://forum.suricata.io/t/removing-icons-from-emergingthreats-rules/6106/1 "2025-11-12T08:47:35Z")

</div>

Good morning,

Is there any way to delete/remove/eliminate the icons that appear in EmergingThreats signatures with suricata-update? They are frankly annoying and cause multiple problems with event management tools.

Many thanks.

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [November 12, 2025, 9:46am UTC](https://forum.suricata.io/t/removing-icons-from-emergingthreats-rules/6106/2 "2025-11-12T09:46:34Z")

</div>

I haven’t see them in ET, only in the pawpatrules. In any case Suricata can’t filter them out for you. Perhaps it can be done with a `suricata-update` modify rule?

---

<div class="post-metadata">

**Author:** ![clopmz](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@clopmz](https://forum.suricata.io/u/clopmz)\
**Post date:** [November 12, 2025, 4:46pm UTC](https://forum.suricata.io/t/removing-icons-from-emergingthreats-rules/6106/3 "2025-11-12T16:46:20Z")

</div>

Uhmm … I am using only ET-Open rules … no pawpatrules

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [November 12, 2025, 5:41pm UTC](https://forum.suricata.io/t/removing-icons-from-emergingthreats-rules/6106/4 "2025-11-12T17:41:40Z")

</div>

Oh. Could you give an example of such icons, in that case, then?

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [November 13, 2025, 4:57am UTC](https://forum.suricata.io/t/removing-icons-from-emergingthreats-rules/6106/5 "2025-11-13T04:57:01Z")

</div>

Or even better, the rule(s) itself.