CLI Reference
rule
condition

`rsigma rule condition`

Parse a Sigma condition expression and print the AST.

Synopsis

rsigma rule condition [OPTIONS] <EXPR>

Description

Takes a Sigma condition string (the right-hand side of condition: in a rule) and prints its parsed AST as JSON. Useful for tooling that reasons about condition trees, for sanity-checking a complicated expression before pasting it into a rule, and for understanding precedence on expressions with mixed and, or, not, and 1 of/all of quantifiers.

Flags

Flag	Description
`<EXPR>`	The condition expression to parse. Quote the argument so the shell does not eat the `*` or `(` characters.

Examples

Simple selection

rsigma rule condition 'selection'

Combined selections

rsigma rule condition 'selection and not filter'

Quantified expressions

rsigma rule condition '1 of selection_* and not filter_*'

Aggregate (correlation) syntax

rsigma rule condition 'selection | count() by User > 5'

Exit codes

Code	Meaning
`0`	Expression parsed cleanly.
`2`	Parse error.