timescale / rsigma

A complete Sigma detection engineering toolkit: parser, linter, formatter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:

Why this job: matched by what the repo talks about: mcp, server, engine, framework

Open on GitHub Website

What it does

Sigma parsing. Parses Sigma YAML into a strongly-typed AST with support for detection, correlation, and filter rules
Array matching (experimental). Matches members of arrays in nested event data with any/all-member semantics, same-element correlation, and positional indexing, opt-in via sigma-version: 3
Rule drafting. Drafts detection rules and temporal correlations from exemplar events contrasted against a baseline corpus with rule draft
Rule tuning. Proposes a spec-native filter from false-positive events, verifies that every known true positive still fires, and refuses unsafe separators with rule tune
Built-in linter. Validates rules with 90 checks, four severity levels, suppressions, custom tag namespaces, and auto-fix for 14 safe rules