Are you the author? Sign in to claim
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, str
A complete Sigma detection engineering toolkit
RSigma is a complete detection engineering toolkit for the Sigma detection standard, including a parser, evaluation engine, rule conversion, streaming runtime, linter, CLI, MCP, and LSP.
RSigma parses Sigma YAML rules into a strongly-typed AST, compiles them into optimized matchers, and evaluates them against log events in real time. It handles stateful correlation logic in-process with memory-efficient compressed event storage. Or as Zack Allen put it in DEW #149, "RSigma is essentially a SIEM."
You can send events in many formats, including JSON, syslog (RFC 3164/5424), logfmt, CEF, EVTX (Windows Event Log), plain text, and OTLP (OpenTelemetry Protocol), with auto-detection by default. pySigma-compatible processing pipelines handle field mapping and backend configuration. OTLP support lets any OpenTelemetry-compatible agent (Grafana Alloy, Vector, Fluent Bit, OTel Collector) forward logs to RSigma via HTTP or gRPC for detection.
For rule quality and editor integration, a built-in linter validates rules against 85 checks derived from the Sigma v2.1.0 specification, and an LSP server provides real-time diagnostics, completions, hover documentation, and quick-fix code actions in any editor.
RSigma builds on open industry standards throughout: Sigma for detection rules, OpenTelemetry for log ingestion and detection export, and STIX and TAXII for threat intelligence.
Full documentation, including guides, CLI reference, and library API docs, lives at timescale.github.io/rsigma.
sigma-version: 3rule draftrsigma.ads.*, enforced by the linter and scaffolded with rule docrsigma mcp serveengine explain, diffs pipeline transformations with pipeline diff, and introspects live correlation windowsrule backtest, emitting a JSON or JUnit XML report for CI--output-format flag; artifact and protocol commands keep their fixed wire format (see the per-command contract)timescale/rsigma-action GitHub Action, wrapping lint, validate, fields-drift diff, backtest, and coveragersigma config command groupengine classify, watches a live daemon for unrecognized sources, and mines candidate signatures with engine discover-schemasproduct/service/category, so a mixed-product stream only pays for the rules that can match--state-db and restores it across restartsengine status, records replayable fixtures with engine tap, and streams live detections with engine tailtemplate, lookup, http, and command primitivesrule coverage and reports gaps against Atomic Red Team, the SigmaHQ baseline, and a target technique listrule visibility, exporting DeTT&CT administration files and a Navigator layer that surfaces blind spotsengine evalrule scorecard into per-rule keep/tune/retire verdictsrule hygiene: silent, noisy, untagged, unowned, incomplete ADS, broken field coverage, or stale statusrule fields| Crate | Description |
|---|---|
rsigma-parser | Parse Sigma YAML into a strongly-typed AST |
rsigma-ir | Intermediate representation shared by evaluation and conversion |
rsigma-eval | Compile and evaluate rules against JSON events |
rsigma-convert | Transform rules into backend-native query strings |
rsigma-runtime | Streaming runtime with input adapters, log processor, and hot-reload |
rsigma-mcp | Model Context Protocol (MCP) server exposing the toolchain as tools for AI agents |
rsigma | CLI for parsing, validating, linting, evaluating, converting rules, field catalog, and running a detection daemon |
rsigma-lsp | Language Server Protocol (LSP) server for IDE support |
rstix | STIX 2.1 library: typed objects, bundle parse/stream, semantic validation, and pattern engine |
[!TIP] To learn more about RSigma, read these articles:
- Pattern Detection and Correlation in JSON Logs
- Streaming Logs to RSigma for Real-Time Detection
- Building a Detection Layer on PostgreSQL with Sigma Rules
- Security Observability with RSigma and the LGTM Stack
- Wiring Live Threat Intel into Sigma Detection with Dynamic Pipelines
- Cloud Detection at Scale on a Laptop
- The State of RSigma
- Detection-as-Code in One GitHub Action with RSigma
- The State of RSigma, Part Two: The Loop
[!NOTE] RSigma has been featured in:
- Detection Engineering Weekly #149 (March 2026) "Building a tool like RSigma is challenging because the Sigma specification has evolved into a robust domain-specific language over the years."
- tl;dr sec #320 (March 2026) "Accurately evaluating the full spectrum of what Sigma rules can express is quite complex, it's pretty neat to read about how RSigma handles all of these conditional expressions, correlating across rules, etc."
- The Deep Purple Sec by BlackNoise - March 2026 (April 2026) "Defensive teams can pipe logs through CLI commands, apply field-mapping pipelines, and chain correlations for multi-stage attack detection."
- Detection Engineering Weekly #154 (April 2026) "RSigma is not a SIEM, but it's an impressive feat to build a self-contained Rust binary that operates much like one. For teams doing pre-SIEM rule validation or forensics, it's a solid plug-and-play option."
- Detection Engineering Weekly #157 (May 2026) "Instead of hardcoding IOC values in rule YAML, you declare external sources in the pipeline config, and RSigma fetches and injects them at evaluation time. This works very similarly to how I've seen SIEMs implement threat intelligence pipelines, but since it's RSigma, it's self-contained within its ecosystem."
Prebuilt binaries for Linux, macOS, and Windows (amd64 and arm64), with SLSA Build L3 provenance, are attached to every GitHub release.
Or install from crates.io:
# Install the CLI
cargo install --locked rsigma
# Install the LSP server
cargo install --locked rsigma-lsp
To build from source:
cargo build --release --all-features --workspace
Multi-arch images (linux/amd64, linux/arm64) are published to GHCR on every release, signed with cosign and carrying an SPDX SBOM and SLSA Build L3 provenance. See the Docker deployment guide.
docker pull ghcr.io/timescale/rsigma:latest
docker run --rm ghcr.io/timescale/rsigma:latest --help
Run with full runtime hardening:
docker run --rm \
--read-only \
--cap-drop=ALL \
--security-opt=no-new-privileges:true \
-v /path/to/rules:/rules:ro \
ghcr.io/timescale/rsigma:latest rule validate /rules/
Verify the image signature:
cosign verify \
--certificate-identity-regexp 'github.com/timescale/rsigma' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/timescale/rsigma:latest
# Evaluate a single event against Sigma rules
rsigma engine eval -r rules/ -e '{"CommandLine": "cmd /c whoami"}'
# Stream NDJSON from stdin (auto-selected when stdout is piped)
cat events.ndjson | rsigma engine eval -r rules/
# Interactive triage in a terminal: width-aligned table view
rsigma engine eval -r rules/ -e @events.ndjson --output-format table
# Recognize which schema each event is (ECS, Sysmon, CEF, OCSF, ...)
cat events.ndjson | rsigma engine classify --output-format table
# Pipe a CSV view into a spreadsheet or data tool
rsigma engine eval -r rules/ -e @events.ndjson --output-format csv > matches.csv
# Run as a daemon with hot-reload and Prometheus metrics
rsigma engine daemon -r rules/ -p ecs.yml --api-addr 0.0.0.0:9090
# Accept events via HTTP POST
rsigma engine daemon -r rules/ --input http
# Check a running daemon's status (rules loaded, events processed, uptime)
rsigma engine status
# Record 30s of a running daemon's live events to a replayable fixture
# (opt-in: start the daemon with --enable-tap)
rsigma engine tap --duration 30s --redact-fields user.email,src_ip -o fixture.ndjson
# Stream a running daemon's live detections to the terminal
# (opt-in: start the daemon with --enable-tail)
rsigma engine tail --level high
# Convert rules to PostgreSQL SQL for historical threat hunting
rsigma backend convert rules/ -t postgres
# Any non-native target delegates to sigma-cli when it is installed (pipx install sigma-cli)
rsigma backend convert rules/ -t splunk
# Draft a detection rule from exemplar events, contrasted against a baseline corpus
rsigma rule draft -e @incident.ndjson --baseline @normal-day.ndjson
# Backtest a corpus against per-rule expectations (CI fixture harness)
rsigma rule backtest -r rules/ --corpus ci/corpus/ --expectations ci/expectations.yml
# Map coverage onto MITRE ATT&CK: export a Navigator layer and gate on a target list
rsigma rule coverage -r rules/ --navigator coverage.json --targets threat-model.txt --fail-on-gaps
See the Quick Start guide for a guided tour and the CLI README for complete documentation of all subcommands and flags.
Expose the toolchain to MCP-aware agents (Cursor, Claude Code, ...) over stdio:
# Run the MCP server (register it in your agent's mcp.json / via `claude mcp add`)
rsigma mcp serve --rules-dir rules/
The agent then calls structured tools (parse_rule, lint_rules, validate_rules, evaluate_events, convert_rules, list_fields, ...) and gets back JSON. See the MCP server guide.
Use the crates directly from Rust:
use rsigma_parser::parse_sigma_yaml;
use rsigma_eval::Engine;
use rsigma_eval::event::JsonEvent;
use serde_json::json;
let yaml = r#"
title: Detect Whoami
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains: 'whoami'
condition: selection
level: medium
"#;
let collection = parse_sigma_yaml(yaml).unwrap();
let mut engine = Engine::new();
engine.add_collection(&collection).unwrap();
let event = JsonEvent::borrow(&json!({"CommandLine": "cmd /c whoami"}));
let matches = engine.evaluate(&event);
assert_eq!(matches[0].rule_title, "Detect Whoami");
A Sigma rule is parsed into a strongly-typed AST (rsigma-parser), lowered into a shared intermediate representation (rsigma-ir), then compiled and evaluated against live events (rsigma-eval inside rsigma-runtime), converted into backend-native queries (rsigma-convert), or served to editors and AI agents (rsigma-lsp, rsigma-mcp). The full walkthrough, covering every module and all four execution shapes, lives in the Architecture reference.
RSigma is designed for high-throughput detection. On an Apple M4 Pro:
See BENCHMARKS.md for full Criterion results across all subsystems.
MIT
Run Claude Code as an MCP server so any agent can delegate coding tasks to it
@microsoft✓ OfficialBrowser automation using accessibility snapshots instead of screenshots
@googleapis✓ OfficialGoogle's universal MCP server supporting PostgreSQL, MySQL, MongoDB, Redis, and 10+ databases
@github✓ OfficialOfficial GitHub integration for repos, issues, PRs, and CI/CD workflows