WRG-11/wrg-sigma-rules

Sigma detection-rule authoring, validation and multi-backend conversion,
delivered as a Model Context Protocol (MCP) server with a published rule corpus.
It runs under Claude Code, Codex, Cursor and any MCP-capable client.
- draft_rule turns a natural-language description into a Sigma YAML scaffold.
- validate_rule checks a rule against pySigma plus a best-practice linter.
- convert_rule compiles a rule to a Splunk, Elastic, OpenSearch or Kibana query.
The corpus holds 294
rules in 16
categories. It covers ransomware and threat-actor activity as well as vulnerabilities
disclosed in AI/LLM applications and MCP servers.
Install
That installs the server as a Claude Code plugin. Codex, Cursor and other MCP clients
take the same server; docs/install.md has the steps for each and the
notes on which interpreter runs it. Captured output from the tools is in
DEMO.md.
The plugin is installed directly from this repository, which is also its own
Claude Code and Codex marketplace; it is not yet listed in Anthropic's plugin
directory.
Skills
There are three Claude Code skills: sigma-rule-writer, sigma-rule-reviewer and
threat-coverage-gap-analyzer. The packaged Codex variants retain the same
evidence boundaries: coverage counts do not establish missing ATT&CK scope,
conversion does not establish deployed semantics, and observed_* public
contributions require the sourcing bar in CONTRIBUTING.md.
Conversion
Conversion runs on pySigma 1.x and targets Splunk SPL, Elastic and Kibana Lucene,
Elastic ES|QL and EQL, OpenSearch Lucene and PPL, plus a wazuh target that
reuses the Elasticsearch Lucene backend and says so in its warnings. The
Lucene-family targets cannot express Sigma correlation rules, so convert_rule
reports the
27
correlation rules in the corpus as a capability gap and names the backends that
can convert them (esql and eql are the Elastic route).
Correlation conversions say where the query stops meaning the rule. Valid syntax
is not the same rule: measured on the pinned backends, opensearch-ppl drops the
time window of every count correlation, and eql turns a distinct-value count
into a join on one repeated value. Each correlation result carries
correlation_semantics, the deviations the converter checks for (dropped or
fixed window, unenforced order, threshold one short); see
Demo 5.
Quick example
Validate and convert a corpus rule end to end, from the repo root:
Full captured output (validate JSON, Splunk SPL, Elasticsearch Lucene) is in
DEMO.md.
The corpus
Every rule lives under resources/examples/ /: one directory per MITRE ATT&CK
Enterprise tactic (v19 names) plus code_review for source-code review rules. Each rule
is one of two kinds:
- template_*: a canonical detection shape to adapt to your own environment.
- observed_*: derived from a specific, cited incident. CONTRIBUTING.md sets
the bar these must clear.
resources/examples/INDEX.json enumerates every
rule, and the wrg-sigma://coverage/mitre-attack-matrix resource computes the
technique-by-tactic breakdown from the corpus at read time. Some rules add a
prose write-up under docs/detection-notes/.
Rule status
This corpus uses Sigma's status: field literally rather than aspirationally:
| status: | Count | Meaning here |
|---|---|---|
| test | 46 | Mostly observed_* rules; CI requires a sidecar sample for every one, with no exceptions |
| experimental | 248 | Both template_* and observed_* rules; new ones need a sidecar sample, older ones may sit in a tracked exception baseline |