Rsigma

A complete Rust toolkit for the Sigma detection standard

RSigma is a complete Rust toolkit for the Sigma detection standard, including a parser, evaluation engine, rule conversion, streaming runtime, linter, CLI, MCP and LSP.

RSigma parses Sigma YAML rules into a strongly-typed AST, compiles them into optimized matchers, and evaluates them against log events in real time. It handles stateful correlation logic in-process with memory-efficient compressed event storage. Or as Zack Allen put it in DEW #149, "RSigma is essentially a SIEM."

You can send events in many formats, including JSON, syslog (RFC 3164/5424), logfmt, CEF, EVTX (Windows Event Log), plain text, and OTLP (OpenTelemetry Protocol), with auto-detection by default. pySigma-compatible processing pipelines handle field mapping and backend configuration. OTLP support lets any OpenTelemetry-compatible agent (Grafana Alloy, Vector, Fluent Bit, OTel Collector) forward logs to RSigma via HTTP or gRPC for detection.

For rule quality and editor integration, a built-in linter validates rules against 70 checks derived from the Sigma v2.1.0 specification, and an LSP server provides real-time diagnostics, completions, hover documentation, and quick-fix code actions in any editor.

Supported Features

• Sigma parsing: Parse Sigma YAML into a strongly-typed AST with support for detection, correlation, and filter rules
• Rule evaluation: Compile and evaluate rules against JSON events in real time with stateless detection and stateful correlation (sliding windows, group-by, chaining, suppression)
• Array matching (experimental): Match members of arrays in nested event data: implicit any-member matching, [any]/[all] object-scope blocks for same-element correlation, and positional [N] indexing, opt-in via sigma-version: 3. Evaluated natively and lowered to PostgreSQL JSONB; see the Array Matching guide
• Streaming daemon: Run as a streaming detection daemon with hot-reload, Prometheus metrics, and HTTP/NATS/OTLP input
• Input formats: Accept JSON, syslog (RFC 3164/5424), logfmt, CEF, EVTX (Windows Event Log), plain text, and OTLP logs with format auto-detection
• Schema recognition: Recognize which schema each event uses (ECS, Sysmon, rendered Windows Event Log, CEF, OCSF, or user-defined) from its content via engine classify, with a live daemon surface (--observe-schemas, GET /api/v1/schemas) and per-schema metrics for spotting unrecognized sources
• Logsource-aware evaluation: Opt-in --logsource-routing skips rules whose product/service/category conflicts with an event's declared logsource, so a mixed-product stream only pays for the rules that can match; conflict-based, fail-open, and backed by a product-partitioned rule index
• Processing pipelines: Use pySigma-compatible processing pipelines for field mapping, transformations, conditions, and finalizers
• Dynamic pipelines: Populate any pipeline value from external sources (HTTP, files, commands, NATS) with template expansion, auto-refresh, and data extraction via jq, JSONPath, or CEL
• Post-evaluation enrichment: Inject contextual data (asset info, IP reputation, identity, GeoIP, runbook URLs, ...) into detection and correlation results via four primitives (template, lookup, http, command) with kind-aware template namespaces, response cache, scope filtering, and hot-reload
• Corpus backtesting: Replay an event corpus against a ruleset with rule backtest, diffing per-rule fire counts against declared expectations (positive/negative fixtures, bounded noise budgets), flagging uncovered fires as potential false positives, and emitting a JSON or JUnit XML report for CI
• ATT&CK coverage: Map a ruleset onto MITRE ATT&CK with rule coverage, exporting an ATT&CK Navigator layer (format 4.5, scored by rule count) and reporting coverage gaps against the Atomic Red Team library, the SigmaHQ baseline heatmap, and a target technique list, with --fail-on-gaps for CI
• Detection scorecard: Fuse the backtest report, the coverage report, an optional Prometheus production-volume snapshot, and an optional triage feed with rule scorecard into per-rule keep/tune/retire verdicts (precision proxy, volume, ATT&CK context, reason), rendered through the output-format layer or as a markdown/HTML artifact, with a sole-coverage guard and --fail-on for CI
• Rule hygiene: Drive the retirement cadence with rule hygiene, which flags candidates in one report (never-fired and noisy over a Prometheus snapshot, untagged via the shared ATT&CK extractor, no-owner, incomplete ADS, broken field coverage via a field-observability snapshot, and deprecated/stale status), rendered through the output-format layer with a --report file and a repeatable --fail-on for CI
• Telemetry visibility: Score data-source maturity with rule visibility, joining the field-observability signal with the rule logsource inventory through a bundled ATT&CK mapping table to emit a DeTT&CT data-source/technique administration pair and a visibility Navigator layer (format 4.5, scored on DeTT&CT's 0-4 scale), surfacing blind spots (rules for data you do not receive) with --fail-on-blind-spots for CI
• Detection-as-Code CI: Gate a rule repository in one step with the timescale/rsigma-action GitHub Action, which wraps rule lint, rule validate, a merge-base fields-drift diff, rule backtest, and rule coverage into a single pull-request check with diff annotations, a sticky summary comment, and verified cached binary installs; see the CI/CD guide
• Rule conversion: Convert rules into backend-native query strings via a pluggable backend trait (PostgreSQL/TimescaleDB SQL, LynxDB SPL2, Fibratus rule YAML for EDR sensors)
• Eval prefilters: Use optional prefilters for large rule sets, including a bloom filter for substring matchers (--bloom-prefilter) and cross-rule Aho-Corasick index for whole-rule pruning (--cross-rule-ac, requires daachorse-index feature)
• Field observability: Opt-in --observe-fields mode on both engine daemon (live, exposed over GET /api/v1/fields* with Prometheus counters) and engine eval (one-shot JSON report at end-of-run, ideal for CI gap analysis) surfaces which event fields no rule references (gap signal) and which rule fields have never appeared in an event (broken-coverage signal); same JSON shape across runtimes
• TLS termination: Use in-process TLS termination for the daemon API listener (HTTP REST, /metrics, OTLP/HTTP, OTLP/gRPC) with optional mutual TLS, aws-lc-rs crypto, and cross-platform certificate hot-reload
• NATS JetStream: Use NATS JetStream support with authentication (credentials, mTLS), replay, consumer groups, and dead-letter queues
• OTLP ingestion: Use OTLP support for any OpenTelemetry-compatible agent (Grafana Alloy, Vector, Fluent Bit, OTel Collector) via HTTP or gRPC
• Webhook alerts: Deliver detections to Slack, Teams, Discord, PagerDuty, or any HTTP endpoint with a generic template-driven webhook sink (per-webhook retry, rate limiting, and DLQ)
• Built-in linter: Validate rules with 70 checks, four severity levels, a full suppression system, configurable custom tag namespaces (--tag-namespace), and auto-fix (--fix) for 13 safe rules
• MCP server: Expose the toolchain to AI agents (Cursor, Claude Code, ...) via rsigma mcp serve: parse, lint, validate, evaluate, convert, fields, and pipeline tools over the Model Context Protocol, with structured JSON results
• LSP server: Use real-time diagnostics, completions, hover documentation, document symbols, and quick-fix code actions
• Docker images: Use multi-arch Docker images (linux/amd64, linux/arm64) with cosign signatures, SBOM, and SLSA Build L3 provenance
• Release binaries: Use cross-platform binaries for Linux, macOS, and Windows on amd64 and arm64

Crates

| Crate | Description | |-------|-------------| | [rsigma-parser](crates/rsigma-parser/) | Parse Sigma YAML into a strongly-typed AST | | [rsigma-eval](crates/rsigma-eval/) | Compile and evaluate rules against JSON events | | [rsigma-convert](crates/rsigma-convert/) | Transform rules into backend-native query strings | | [rsigma-runtime](crates/rsigma-runtime/) | Streaming runtime with input adapters, log processor, and hot-reload | | [rsigma-mcp](crates/rsigma-mcp/) | Model Context Protocol (MCP) server exposing the toolchain as tools for AI agents | | [rsigma](crates/rsigma-cli/) | CLI for parsing, validating, linting, evaluating, converting rules, field catalog, and running a detection daemon | | [rsigma-lsp](crates/rsigma-lsp/) | Language Server Protocol (LSP) server for IDE support | | [rstix](crates/rstix/) | STIX 2.1 library: typed objects, bundle parse/stream, semantic validation (TAXII client planned) |

> [!TIP] > To learn more about RSigma, read these articles: > > - Pattern Detection and Correlation in JSON Logs > - Streaming Logs to RSigma for Real-Time Detection > - Building a Detection Layer on PostgreSQL with Sigma Rules > - Security Observability with RSigma and the LGTM Stack > - Wiring Live Threat Intel into Sigma Detection with Dynamic Pipelines > - Cloud Detection at Scale on a Laptop

> [!NOTE] > RSigma has been featured in: > > - Detection Engineering Weekly #149 (March 2026) > "Building a tool like RSigma is challenging because the Sigma specification has evolved into a robust domain-specific language over the years." > - tl;dr sec #320 (March 2026) > "Accurately evaluating the full spectrum of what Sigma rules can express is quite complex, it's pretty neat to read about how RSigma handles all of these conditional expressions, correlating across rules, etc." > - The Deep Purple Sec by BlackNoise - March 2026 (April 2026) > "Defensive teams can pipe logs through CLI commands, apply field-mapping pipelines, and chain correlations for multi-stage attack detection." > - Detection Engineering Weekly #154 (April 2026) > "RSigma is not a SIEM, but it's an impressive feat to build a self-contained Rust binary that operates much like one. For teams doing pre-SIEM rule validation or forensics, it's a solid plug-and-play option." > - Detection Engineering Weekly #157 (May 2026) > "Instead of hardcoding IOC values in rule YAML, you declare external sources in the pipeline config, and RSigma fetches and injects them at evaluation time. This works very similarly to how I've seen SIEMs implement threat intelligence pipelines, but since it's RSigma, it's self-contained within its ecosystem."

Installation

# Build all crates
cargo build --release --all-features --workspace

# Install the CLI
cargo install --locked rsigma

# Install the LSP server
cargo install --locked --path crates/rsigma-lsp

Docker

Multi-arch images (linux/amd64, linux/arm64) are published to GHCR on every release.

docker pull ghcr.io/timescale/rsigma:latest
docker run --rm ghcr.io/timescale/rsigma:latest --help

Run with full runtime hardening:

docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  -v /path/to/rules:/rules:ro \
  ghcr.io/timescale/rsigma:latest rule validate /rules/

Verify the image signature:

cosign verify \
  --certificate-identity-regexp 'github.com/timescale/rsigma' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/timescale/rsigma:latest

Quick Start

# Evaluate a single event against Sigma rules
rsigma engine eval -r rules/ -e '{"CommandLine": "cmd /c whoami"}'

# Stream NDJSON from stdin (auto-selected when stdout is piped)
cat events.ndjson | rsigma engine eval -r rules/

# Interactive triage in a terminal: width-aligned table view
rsigma engine eval -r rules/ -e @events.ndjson --output-format table

# Recognize which schema each event is (ECS, Sysmon, CEF, OCSF, ...)
cat events.ndjson | rsigma engine classify --output-format table

# Pipe a CSV view into a spreadsheet or data tool
rsigma engine eval -r rules/ -e @events.ndjson --output-format csv > matches.csv

# Run as a daemon with hot-reload and Prometheus metrics
rsigma engine daemon -r rules/ -p ecs.yml --api-addr 0.0.0.0:9090

# Accept events via HTTP POST
rsigma engine daemon -r rules/ --input http

# Check a running daemon's status (rules loaded, events processed, uptime)
rsigma engine status

# Record 30s of a running daemon's live events to a replayable fixture
# (opt-in: start the daemon with --enable-tap)
rsigma engine tap --duration 30s --redact-fields user.email,src_ip -o fixture.ndjson

# Stream a running daemon's live detections to the terminal
# (opt-in: start the daemon with --enable-tail)
rsigma engine tail --level high

# Convert rules to PostgreSQL SQL
rsigma backend convert rules/ -t postgres

See the [CLI README](crates/rsigma-cli/) for complete documentation of all subcommands and flags.

Daemon Input Modes

The daemon accepts events from multiple sources. The --input flag selects the primary source, and OTLP is always available as an additional ingestion path when the daemon-otlp feature is enabled.

# stdin (default): pipe events from any source
hel run | rsigma engine daemon -r rules/ -p ecs.yml

# HTTP: POST NDJSON events to /api/v1/events
rsigma engine daemon -r rules/ --input http
curl -X POST http://localhost:9090/api/v1/events -d '{"CommandLine":"whoami"}'

# NATS JetStream (requires daemon-nats feature)
rsigma engine daemon -r rules/ --input nats://localhost:4222/events.> --output nats://localhost:4222/detections

# OTLP (requires daemon-otlp feature): always active alongside any --input mode
# Agents (Grafana Alloy, Vector, Fluent Bit, OTel Collector) send logs to /v1/logs (HTTP) or gRPC
rsigma engine daemon -r rules/ --input http
curl -X POST http://localhost:9090/v1/logs -H 'Content-Type: application/json' -d '{"resourceLogs":[...]}'

NATS Streaming

Production-grade NATS JetStream support with authentication, at-least-once delivery, replay, and horizontal scaling via consumer groups.

# Credentials file authentication
rsigma engine daemon -r rules/ --input nats://nats.example.com:4222/events.> --nats-creds /etc/rsigma/nats.creds

# Mutual TLS
rsigma engine daemon -r rules/ --input nats://localhost:4222/events.> \
  --nats-tls-cert client.pem --nats-tls-key client-key.pem --nats-require-tls

# Replay from a point in time
rsigma engine daemon -r rules/ --input nats://localhost:4222/events.> --replay-from-time 2026-04-30T00:00:00Z

# Replay with automatic state restore (forward catch-up)
rsigma engine daemon -r rules/ --input nats://localhost:4222/events.> --replay-from-sequence 1001 --state-db state.db

# Consumer groups for horizontal

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [timescale](https://github.com/timescale)
- **Source:** [timescale/rsigma](https://github.com/timescale/rsigma)
- **License:** MIT
- **Homepage:** https://timescale.github.io/rsigma/

Install and usage instructions live in the source repository linked above.