diff --git a/rules/Makefile.am b/rules/Makefile.am
index faa85668e3..f176abb61e 100644
--- a/rules/Makefile.am
+++ b/rules/Makefile.am
@@ -25,6 +25,7 @@ quic-events.rules \
 rfb-events.rules \
 smb-events.rules \
 smtp-events.rules \
+snmp-events.rules \
 ssh-events.rules \
 stream-events.rules \
 tls-events.rules \
diff --git a/rules/README.md b/rules/README.md
index a0c031256f..396ab1bacc 100644
--- a/rules/README.md
+++ b/rules/README.md
@@ -30,6 +30,7 @@ signature IDs.
 | FTP      | 2232000 | 2232999 |
 | POP3     | 2236000 | 2236999 |
 | LDAP     | 2237000 | 2237999 |
+| SNMP     | 2238000 | 2238999 |
 | DNS      | 2240000 | 2240999 |
 | PGSQL    | 2241000 | 2241999 |
 | mDNS     | 2242000 | 2242999 |
diff --git a/rules/snmp-events.rules b/rules/snmp-events.rules
new file mode 100644
index 0000000000..ed13c2136d
--- /dev/null
+++ b/rules/snmp-events.rules
@@ -0,0 +1,9 @@
+# SNMP app layer event rules
+#
+# SID's fall in the 2238000+ range. See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+#
+# These sigs fire at most once per connection.
+#
+alert snmp any any -> any any (msg:"SURICATA SNMP malformed data"; app-layer-event:snmp.malformed_data; classtype:protocol-command-decode; sid:2238000; rev:1;)
+alert snmp any any -> any any (msg:"SURICATA SNMP unknown security model"; app-layer-event:snmp.unknown_security_model; classtype:protocol-command-decode; sid:2238001; rev:1;)
+alert snmp any any -> any any (msg:"SURICATA SNMP version mismatch"; app-layer-event:snmp.version_mismatch; classtype:protocol-command-decode; sid:2238002; rev:1;)