Welcome to RSigma’s documentation!
RSigma is a Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, and MCP and LSP servers. It builds on open industry standards throughout: Sigma for detection rules, OpenTelemetry for log ingestion and detection export, and STIX and TAXII for threat intelligence.
Install with a signed binary archive, Docker, or Cargo.
Write a rule, evaluate it, run the daemon, and convert to SQL.
Sigma rules, processing pipelines, the eval/daemon split, and the noun-led CLI.
Author, test, deploy, detect, alert, measure, and hunt: one map of the full lifecycle.
Per-subcommand reference for engine, rule, backend, pipeline, config, and mcp.
Generate PostgreSQL, LynxDB, or Fibratus queries from Sigma rules for historical hunting.
Run the daemon with NATS, HTTP, or OTLP input. Hot-reload, metrics, state.
Why RSigma
| RSigma | pySigma | sigma_engine | sigma-rust | |
|---|---|---|---|---|
| Language | Rust | Python | Rust | Rust |
| Runtime evaluation | Yes (streaming + stateful) | No (converter only) | Yes (stateless) | Yes (stateless) |
| Correlation rules | All 8 types | Partial | No | No |
| Filter rules | Yes | Yes | No | No |
| Conversion backends | PostgreSQL, LynxDB, Fibratus | 20+ | No | No |
| Streaming daemon | Yes (NATS, HTTP, OTLP) | No | No | No |
| Dynamic pipelines | Yes (HTTP, file, command, NATS) | Yes (HTTP, file, command) | No | No |
| Built-in linter | 85 rules, auto-fix | Limited | No | No |
| LSP server | Yes | No | No | No |
| Single binary | Yes (multi-arch, signed) | No (requires Python) | Library only | Library only |
| License | MIT | LGPL-3.0 | AGPL-3.0 | MIT |
RSigma combines pySigma-style conversion with a streaming evaluator in one self-contained binary.
Featured in
| Outlet | Quote |
|---|---|
| DEW #149 (March 2026) | “RSigma is essentially a SIEM. Building a tool like RSigma is challenging because the Sigma specification has evolved into a robust domain-specific language over the years.” |
| tl;dr sec #320 (March 2026) | “Accurately evaluating the full spectrum of what Sigma rules can express is quite complex. It’s pretty neat to read about how RSigma handles all of these conditional expressions, correlating across rules, etc.” |
| BlackNoise (March 2026) | “Defensive teams can pipe logs through CLI commands, apply field-mapping pipelines, and chain correlations for multi-stage attack detection.” |
| DEW #154 (April 2026) | “RSigma is not a SIEM, but it’s an impressive feat to build a self-contained Rust binary that operates much like one. For teams doing pre-SIEM rule validation or forensics, it’s a solid plug-and-play option.” |
| DEW #157 (May 2026) | “Instead of hardcoding IOC values in rule YAML, you declare external sources in the pipeline config, and RSigma fetches and injects them at evaluation time.” |
| This Week in Rust 663 (August 2026) | Featured the RSigma v0.20.0 release and The State of RSigma, and Part Two: The Loop. |
Built with RSigma
| Project | Role |
|---|---|
| detection.studio | Browser-based Sigma playground with real-time evaluation via RSigma compiled to WebAssembly |
| LocalObserve | Local-first Linux security observability stack using RSigma for edge Sigma detection and webhook alerting |
| Rustinel | Cross-platform endpoint detection engine with RSigma as an opt-in Sigma backend for live telemetry |
| Sigmacatch | Captures live Windows Event Log events, matches them with RSigma, and writes SigmaHQ-ready regression data |
Read the deep dives
An article series on building RSigma and using it in production:
| # | Article | Topic |
|---|---|---|
| 1 | Pattern Detection and Correlation in JSON Logs | Forensic investigation of a Trivy supply-chain compromise |
| 2 | Streaming Logs to RSigma for Real-Time Detection | Okta cross-tenant impersonation via the daemon and NATS JetStream |
| 3 | Building a Detection Layer on PostgreSQL with Sigma Rules | Five PostgreSQL output formats and TimescaleDB continuous aggregates |
| 4 | Security Observability with RSigma and the LGTM Stack | Pairing RSigma with Loki, Mimir, and Grafana |
| 5 | Wiring Live Threat Intel into Sigma Detection with Dynamic Pipelines | Dynamic pipelines: HTTP, file, command, and NATS sources |
| 6 | Cloud Detection at Scale on a Laptop | Running cloud-scale detection locally with RSigma |
| 7 | The State of RSigma | A tour of everything RSigma does today and where it is headed |
| 8 | Detection-as-Code in One GitHub Action with RSigma | Gating a Sigma rule repository in CI with lint, validate, fields-drift, backtest, and ATT&CK coverage |
| 9 | The State of RSigma, Part Two: The Loop | One detection through the full lifecycle: author, test, deploy, detect, alert and triage, measure, and hunt |
At a glance
- Latest release:
v0.21.0(MIT licensed; seven crates in the workspace). - MSRV: Rust
1.88.0, edition2024. - Cross-platform binaries: Linux, macOS, Windows on amd64 and arm64.
- Container image:
ghcr.io/timescale/rsigma:latest(multi-arch, cosign-signed, SBOM, SLSA Build L3 provenance). - Benchmarks: detection and correlation throughput numbers live on the benchmarks page.
