rsigma

Project Overview

RSigma is a complete detection engineering toolkit for the Sigma detection standard. It includes a parser, evaluation engine, rule conversion, streaming runtime, linter, CLI, MCP, and LSP. RSigma parses Sigma YAML rules into a strongly-typed AST, compiles them into optimized matchers, and evaluates them against log events in real time. It supports many log formats, including JSON, syslog (RFC 3164/5424), logfmt, CEF, EVTX (Windows Event Log), plain text, and OTLP (OpenTelemetry Protocol), with auto-detection by default. OTLP support lets any OpenTelemetry-compatible agent forward logs to RSigma for detection.

Key Features

• Sigma parsing: Parses Sigma YAML into a strongly-typed AST with support for detection, correlation, and filter rules
• Array matching (experimental): Matches members of arrays in nested event data with any/all-member semantics, same-element correlation, and positional indexing
• Rule drafting: Drafts a detection rule from exemplar events contrasted against a baseline corpus
• Rule tuning: Proposes a spec-native filter from false-positive events and verifies true positives still fire
• Built-in linter: Validates rules with 85 checks, four severity levels, suppressions, custom tag namespaces, and auto-fix for 14 safe rules
• ADS metadata: Documents rules with Palantir ADS sections, enforced by the linter
• LSP server: Provides real-time diagnostics, completions, hover documentation, document symbols, and quick-fix code actions
• pySigma-compatible pipelines: Handle field mapping and backend configuration
• STIX and TAXII support: For threat intelligence integration

Target Audience

• Security engineers and detection engineers
• SIEM developers and operators
• Teams who need Sigma rule management

Quick Start

1. Download prebuilt binaries for Linux, macOS, or Windows (amd64 and arm64) from GitHub Releases
2. Or install from crates.io: cargo install --locked rsigma
3. Install the LSP server: cargo install --locked rsigma-lsp
4. Use Docker multi-arch images (linux/amd64, linux/arm64)
5. Convert rules: rsigma backend convert rules/ -t splunk

Core Advantages

• Complete Sigma toolchain: parser, evaluator, conversion, runtime
• OTLP support — any OpenTelemetry-compatible agent can forward logs for detection
• Built-in LSP server for real-time diagnostics and completions
• Built on open standards: Sigma, OpenTelemetry, STIX/TAXII

System Requirements

• OS: Linux, macOS, Windows
• Architectures: amd64, arm64