rsigma
Active·★ 172·MIT·Updated 2026-10-22
RSigma is a comprehensive detection engineering toolkit for the Sigma detection standard, offering a parser, evaluation engine, rule conversion, streaming runtime, linter, CLI, MCP, and LSP. It processes Sigma YAML rules into a strongly-typed AST, compiles them into optimized matchers, and evaluates them against log events in real time, featuring in-process stateful correlation logic.
#Sigma#Detection Engineering#Security Monitoring#Real-time Analytics#Log Analysis#Threat Detection#Rule Engine#Rust
01
Features
01Real-time Sigma rule parsing and evaluation with in-process stateful correlation logic.
02Built-in linter, LSP server, and MCP server for comprehensive rule authoring and AI agent integration.
03Flexible log ingestion (JSON, OTLP, EVTX, syslog) and extensible alert delivery (webhooks, NATS, OTLP).
04Rule conversion to backend-native queries and advanced detection engineering metrics (ATT&CK coverage, scorecard).
02
Compatibility
Rust
Runtime
Verified via docs
Linux
Operating System
Verified via docs
macOS
Operating System
Verified via docs
Windows
Operating System
Verified via docs
Docker
Containerization
Verified via docs
OpenTelemetry
Protocol
Verified via docs
03
Quick start
1
$ cargo install --locked rsigma
2
$ cargo install --locked rsigma-lsp
04
Use cases
↳Real-time security threat detection by streaming log events against Sigma rules.
↳Automating detection engineering workflows, including rule validation, backtesting, and ATT&CK coverage analysis in CI/CD.
↳Converting Sigma rules into native queries for various SIEMs or databases for historical threat hunting.
↳Enhancing security operations with AI agents through the MCP server for advanced rule drafting and analysis.
05
Alternatives
WonderSuite-Ai-Bug-Bounty★ 51
AI-Powered Offensive Security Research Engine - desktop-native security testing platform with native MCP integration. 90 tools, MITM proxy, stealth browser, autonomous AI agent. Built on Tauri + Rust + React.
AiSOC★ 2.8k
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
rea★ 365.5k
Reverse engineer anything with agents: one CLI and MCP server to inspect any app, understand it fully down to the binary level.
mcp-for-security★ 629
MCP for Security: A collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan and more. Integrate security testing and penetration testing into AI workflows.
Comments
Log in to leave a comment
No comments yet. Be the first!