{"repo":"timescale/rsigma","free":true,"listed":false,"github":"https://github.com/timescale/rsigma","clone":"git clone https://github.com/timescale/rsigma.git","description":"A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:","language":"Rust","stars":133,"topics":["detection","rust","sigma","backend","correlation","siem","postgres","timescaledb","lsp","converter"],"license":"MIT","category":"databases-storage","readme_excerpt":"A complete Sigma detection engineering toolkit RSigma is a complete detection engineering toolkit for the Sigma detection standard, including a parser, evaluation engine, rule conversion, streaming runtime, linter, CLI, MCP, and LSP. RSigma parses Sigma YAML rules into a strongly-typed AST, compiles them into optimized matchers, and evaluates them against log events in real time. It handles stateful correlation logic in-process with memory-efficient compressed event storage. Or as Zack Allen put it in DEW #149, \"RSigma is essentially a SIEM.\" You can send events in many formats, including JSON, syslog (RFC 3164/5424), logfmt, CEF, EVTX (Windows Event Log), plain text, and OTLP (OpenTelemetry Protocol), with auto-detection by default. pySigma-compatible processing pipelines handle field mapping and backend configuration. OTLP support lets any OpenTelemetry-compatible agent (Grafana Alloy, Vector, Fluent Bit, OTel Collector) forward logs to RSigma via HTTP or gRPC for detection. For rule quality and editor integration, a built-in linter validates rules against 85 checks derived from the Sigma v2.1.0 specification, and an LSP server provides real-time diagnostics, completions, hover documentation, and quick-fix code actions in any editor. RSigma builds on open industry standards throughout: Sigma for detection rules, OpenTelemetry for log ingestion and detection export, and STIX and TAXII for threat intelligence. Full documentation, including guides, CLI reference, and library A","default_branch":null,"files":null,"tree":[],"storefront":"/r/timescale","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/timescale/rsigma/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}