Skip to main content
llmgod
llmgod
Visitor II
September 15, 2026
Question

Lua scripting support

  • September 15, 2026
  • 1 reply
  • 36 views

I'm developing a custom IPS signature for FortiOS 7.4 and want to understand the Lua scripting support in custom IPS rules. Specifically:

(1) Can custom IPS rules written in Lua access the os and io modules?

(2) Are there any sandboxing restrictions on what Lua code can do in a custom IPS rule handler?

(3) Is the Lua state for IPS rules a shared state or per-session isolated state?

1 reply

osoleimani
Staff
osoleimani
Staff
September 15, 2026

Hi lmgod,

Interesting questions. I checked the public FortiOS 7.4 IPS documentation, and the documented custom IPS mechanism is the F-SBID signature language, with protocol, payload, special, and application options. The public 7.4 documentation does not appear to document the Lua runtime environment, including access to “os” / “io”, sandbox restrictions, or Lua-state lifetime.

Because those details concern the IPS engine's internal execution environment, I would be cautious about assuming standard Lua behavior for a custom IPS handler without Fortinet-specific documentation confirming it.

FortiOS 7.4 — Custom IPS and Application Control Signature Syntax Guide

Hope this helps distinguish what is publicly documented from the IPS engine internals you're asking about.

    Terms & ConditionsAccessibility statement