Most detection engines get slow the moment you load the real rule pack. RSigma v0.21.0 is out, and it now keeps the full pack and still keeps up. Repo: github.com/timescale/rs... Release notes: github.com/timescale/rs...

GitHub - timescale/rsigma: A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:

A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab: - timescale/rsigma

github.com

I overhauled RSigma's performance on real-world SigmaHQ workloads, increasing the routed Windows daemon’s throughput from roughly 14.5k to 754.8k events per second on eight performance cores. Sound candidate indexing delivered 13-22.8x single-core gains: rsigma.io/guide/perfor...

RSigma is a complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers. Repo: github.com/timescale/rs... GHA: github.com/timescale/rs... Docs: rsigma.io

Your best detections are stuck in one vendor's query language. RSigma v0.20.0 runs both ways: paste an Elastic/Lucene query, get back portable Sigma YAML. Plus a new IR engine, a TAXII 2.1 client, and cloud log auto-routing. Rust, single binary, open source. github.com/timescale/rs...

RSigma is now listed under Security Tools on awesome-rust: github.com/rust-unoffic...

GitHub - rust-unofficial/awesome-rust: A curated list of Rust code and resources.

A curated list of Rust code and resources. Contribute to rust-unofficial/awesome-rust development by creating an account on GitHub.

github.com

Hand-writing detection rules from a blank file is the slowest part of the job. RSigma v0.19.0 is out, taking the Rust Sigma engine from "here are some suspicious events" to "here's a tested draft rule". Feedback and testers very welcome. Release notes: github.com/timescale/rs...

The last State of RSigma promised to close the detection engineering loop. It closed. Part two follows one detection around it: drafted from real events, gated in CI, caught in production, judged, measured, and hunted into the next rule. Seven stations, one binary. mostafa.dev/the-state-of...

10,000 alerts is not a detection strategy. RSigma v0.18.0 takes the Rust Sigma engine from "a rule fired" to "an alert worth reading": • Alert pipeline • Risk-based alerting • Triage feedback loop • Rule hygiene, schema and logsource routing, STIX 2.1 support and more github.com/timescale/rs...

RSigma has a GitHub Action for detection-as-code now, which uses the capabilities released in RSigma v0.17.0 last week. github.com/timescale/rs... To showcase these capabilities, I just published the 7th article in RSigma series: mostafa.dev/detection-as...

Anyone can write a detection rule. The real question is: can you prove it works? RSigma v0.17.0 turns detection from a guessing game into an engineering loop. Write rules. Measure them. Tune the noisy ones. Retire the dead ones. github.com/timescale/rs...

Your SIEM's rules, running in real time, in a tiny Rust binary, anywhere you want. RSigma isn't a SIEM, and that's exactly the point. mostafa.dev/the-state-of...

The State of RSigma

A tour of what one Rust binary does for detection engineering today, and where it is headed

mostafa.dev

Detection-as-Code, now native in AI coding agents. RSigma v0.16.0 adds an MCP server: point Cursor, Claude Code, or any MCP client at it and your agent can parse, lint, validate, evaluate, convert, and fix Sigma rules as typed tools, getting structured JSON. github.com/timescale/rs...

RSigma v0.15.0 is out, focused on new conversion targets and Sigma extensions. 🚀 Highlights: • Fibratus backend • Array matching • Correlation window modes Release notes: github.com/timescale/rs...

My 3rd SEP (dynamic correlation windows) was rejected: windowing is a backend concern. RSigma ships it anyway: SEP: github.com/SigmaHQ/sigm... RSigma implementation: github.com/timescale/rs...

SEP: Dynamic Time Windows for Correlation Rules (sliding, tumbling, session) · Issue #214 · SigmaHQ/sigma-specification

Author(s) Mostafa Moradian SEP Type New Detection Logic (correlation types, aggregation functions) (Secondary: New Rule Fields, since it adds the window and gap attributes to the correlation sectio...

github.com

My 3rd proposal to the Sigma specification is up for review. Feedback is more than welcome! github.com/SigmaHQ/sigm...

One of the biggest releases of RSigma is out! 🚀 It includes layered YAML configuration, structured output and lots of overdue maintenance. Thanks to Fabian Wosar for contributing a nice feature to the linter. Repo: github.com/timescale/rs... Release notes: github.com/timescale/rs...

My second proposal to Sigma specification is up for review and feedback is much appreciated: github.com/SigmaHQ/sigm...

SEP: Rule-Level Specification Version Declaration · Issue #213 · SigmaHQ/sigma-specification

SEP: Rule-Level Specification Version Declaration Relates to: sigma-specification SEP #212 (Array Matching in Sigma), sigma-specification Discussion #106. Spun out of SEP #212. The mechanism was ra...

github.com

This is RSigma:

I am contributing the macOS port to Rustinel: github.com/Karib0u/rust...

GitHub - Karib0u/rustinel: Open-source endpoint detection engine for Windows and Linux using ETW, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

Open-source endpoint detection engine for Windows and Linux using ETW, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts. - Karib0u/rustinel

github.com

I guess I'm an influencer now. Don't believe me? The receipts are public: github.com/SigmaHQ/pySi...

Add processing pipeline modifier to obtain placeholder replacements from external data sources · Issue #470 · SigmaHQ/pySigma

Inspired by @mostafa's work in RSigma, external data sources would also be useful in pySigma's conversion use case. This should be implemented as new processing transformations for different types ...

github.com

Based on the previous work and discussions on the Sigma Specification and the RSigma project, I created a Sigma Enhancement Proposal for Array Matching in Sigma. Please read and provide feedback. github.com/SigmaHQ/sigm...

Issue · SigmaHQ/sigma-specification

Sigma rule specification. Contribute to SigmaHQ/sigma-specification development by creating an account on GitHub.

github.com

RSigma v0.13.0 is out. Here's a sneak peek: 1. Post-evaluation enrichment. 2. Server-side TLS on the daemon API. 3. Field observability. 4. A unified EvaluationResult library API 5. Detached dynamic sources via a new --source flag. github.com/timescale/rs...

Release v0.13.0 · timescale/rsigma

TL;DR RSigma v0.13.0 is the "post-evaluation enrichment, server-side TLS, and field observability" release: Post-evaluation enrichment between engine.evaluate() and the sinks: four primitives (tem...

github.com

My sixth blog post about RSigma is out. In this one, I walk through how it detects suspicious events across 1.9M CloudTrail records. As always, feedback is welcome and much appreciated. mostafa.dev/cloud-detect...

RSigma v0.12.0 is out! 🎉 It contains improved daemon and CLI observability, fast Sigma rule loading, reorganized set of CLI subcommands, full-on documentation, improved test reliability and deps version bumps. Release notes: github.com/timescale/rs... Documentation: timescale.github.io/rsigma/

Release v0.12.0 · timescale/rsigma

TL;DR RSigma v0.12.0 is the

github.com

Detection Studio added support for real-time Sigma rule evaluation against sample data using RSigma: Website: detection.studio GitHub repo: github.com/northsh/dete... RSigma: github.com/timescale/rs...

Just shipped RSigma v0.11.0, the biggest eval engine update yet. 𝐇𝐢𝐠𝐡𝐥𝐢𝐠𝐡𝐭𝐬: • Matcher optimizer • Opt-in bloom filter prefilter • Opt-in cross-rule Aho-Corasick prefilter • Security hardening • Many more All optimizations are backward-compatible. github.com/srdnlen/rsig...

I just published my newest article, and the fifth in my RSigma series: “Wiring Live Threat Intel into Sigma Detection with Dynamic Pipelines” Dynamic pipelines let you turn public threat feeds into live detections without rewriting a single Sigma rule. mostafa.dev/wiring-live-...

RSigma v0.10.0, the "dynamic pipelines" release, is out. 🚀 What's new: • Dynamic Sigma Pipelines • Native EVTX input • 14 cargo-fuzz harnesses • Pipeline hot-reload and two builtin pipelines Release notes: github.com/timescale/rs... Contributions and feedback are welcome.

Release v0.10.0 · timescale/rsigma

TL;DR RSigma v0.10.0 is the "dynamic pipelines" release: Dynamic Sigma Pipelines: declare HTTP, command, file, and NATS sources inside pipeline YAML, with template expansion, include directives, T...

github.com

In my new article, I cover an E2E security observability solution using RSigma, LGTM stack and more. The core technique is creating a single Grafana Alerting rule with dynamic labels, allowing metric labels to be extracted and reported as separate alert instances. mostafa.dev/security-obs...

RSigma v0.9.0 is released! 🚀 • Production-grade NATS JetStream • Native OpenTelemetry log ingestion • LynxDB conversion backend • Field catalog • Structured exit codes for CI/CD scripting • Per-rule Prometheus metric labels • Comprehensive E2E test suite github.com/timescale/rs...