timescale/rsigma

RSigma is a complete detection engineering toolkit for the Sigma detection standard, including a parser, evaluation engine, rule conversion, streaming runtime, linter, CLI, MCP, and LSP.
RSigma parses Sigma YAML rules into a strongly-typed AST, compiles them into optimized matchers, and evaluates them against log events in real time. It handles stateful correlation logic in-process with memory-efficient compressed event storage. Or as Zack Allen put it in DEW #149, "RSigma is essentially a SIEM."
You can send events in many formats, including JSON, syslog (RFC 3164/5424), logfmt, CEF, EVTX (Windows Event Log), plain text, and OTLP (OpenTelemetry Protocol), with auto-detection by default. pySigma-compatible processing pipelines handle field mapping and backend configuration. OTLP support lets any OpenTelemetry-compatible agent (Grafana Alloy, Vector, Fluent Bit, OTel Collector) forward logs to RSigma via HTTP or gRPC for detection.
For rule quality and editor integration, a built-in linter validates rules against 90 checks derived from the Sigma v2.1.0 specification, and an LSP server provides real-time diagnostics, completions, hover documentation, and quick-fix code actions in any editor.
RSigma builds on open industry standards throughout: Sigma for detection rules, OpenTelemetry for log ingestion and detection export, and STIX and TAXII for threat intelligence.
Full documentation, including guides, CLI reference, and library API docs, lives at rsigma.io.
Supported Features
Author
* **Sigma parsing:** Parses Sigma YAML into a strongly-typed AST with support for detection, correlation, and filter rules
* **Array matching (experimental):** Matches members of arrays in nested event data with any/all-member semantics, same-element correlation, and positional indexing, opt-in via sigma-version: 3
* **Rule drafting:** Drafts detection rules and temporal correlations from exemplar events contrasted against a baseline corpus with rule draft
* **Rule tuning:** Proposes a spec-native filter from false-positive events, verifies that every known true positive still fires, and refuses unsafe separators with rule tune
* **Built-in linter:** Validates rules with 90 checks, four severity levels, suppressions, custom tag namespaces, and auto-fix for 14 safe rules
* **ADS metadata:** Documents rules with Palantir ADS sections under rsigma.ads.*, enforced by the linter and scaffolded with rule doc
* **LSP server:** Provides real-time diagnostics, completions, hover documentation, document symbols, and quick-fix code actions in VSCode, Neovim, and any LSP-capable editor
* **MCP server:** Exposes the toolchain to AI agents (Cursor, Claude Code, ...) as structured MCP tools over stdio or Streamable HTTP with rsigma mcp serve
Test
* **Detection diagnostics:** Explains why a rule did or did not match an event with engine explain, diffs pipeline transformations with pipeline diff, and introspects live correlation windows
* **Corpus backtesting:** Replays an event corpus against declared per-rule expectations with rule backtest, emitting a JSON or JUnit XML report for CI
* **Output formats:** Structured commands render JSON, NDJSON, table, CSV, or TSV with a TTY-aware default via a global --output-format flag; artifact and protocol commands keep their fixed wire format (see the per-command contract)
Deploy
* **CI integration:** Gates a rule repository in one pull-request check with the timescale/rsigma-action GitHub Action, wrapping lint, validate, fields-drift diff, backtest, and coverage
* **Configuration:** Layers settings from YAML config files, environment variables, and CLI flags, managed with the rsigma config command group
* **Signed artifacts:** Ships multi-arch Docker images with cosign signatures, SBOM, and SLSA Build L3 provenance, plus prebuilt binaries for Linux, macOS, and Windows
Detect
* **Rule evaluation:** Compiles rules into optimized matchers and evaluates them against events in real time, with stateless detection and stateful correlation (sliding/tumbling/session windows, group-by, chaining, suppression)