Installation

RSigma ships as a single self-contained binary on every supported platform. Pick the install method that matches your environment.

Requirements

• Platform: Linux, macOS, or Windows on x86_64 or arm64.
• Disk: ~25 MB (varies with enabled features).
• Runtime deps: none beyond system libc (statically linked otherwise).
• Daemon: inbound port for the management/metrics API (default 0.0.0.0:9090).
• From source: Rust 1.88.0 or newer (2024 edition).

Prebuilt binaries

The fastest path for most users. Cross-platform release archives are attached to every GitHub release. Targets:

# Linux/macOS, swap the URL for your target
curl -fsSL -o rsigma.tar.gz \
  https://github.com/timescale/rsigma/releases/download/v0.21.0/rsigma-x86_64-unknown-linux-gnu.tar.gz
tar -xzf rsigma.tar.gz
sudo install -m 0755 rsigma /usr/local/bin/rsigma
rsigma --version

Every archive ships with a SLSA build provenance attestation generated by actions/attest-build-provenance. Verify with the GitHub CLI:

gh attestation verify rsigma-x86_64-unknown-linux-gnu.tar.gz --repo timescale/rsigma

Cosign keyless signatures live on the GHCR Docker image (see Docker below); archives use SLSA attestations instead.

Docker

Multi-arch images (linux/amd64, linux/arm64) are published to GitHub Container Registry on every release. Tags include the version (0.21.0), latest, and per-commit SHAs.

docker pull ghcr.io/timescale/rsigma:latest
docker run --rm ghcr.io/timescale/rsigma:latest --help

Run with full runtime hardening for production:

docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  -v /path/to/rules:/rules:ro \
  ghcr.io/timescale/rsigma:latest rule validate /rules/

The image is signed with Sigstore keyless cosign and ships with an SBOM and SLSA Build L3 provenance attestation. Verify before deploying:

cosign verify \
  --certificate-identity-regexp 'github.com/timescale/rsigma' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/timescale/rsigma:latest

See the Docker deployment guide for compose files, hardened systemd units, and Kubernetes-style runtime flags.

With Cargo

For Rust users who already have a toolchain. Installs the latest released 0.21.0 build with default features (only daemon on; the MCP server, NATS, OTLP, TLS, and the extra input formats are opt-in):

cargo install --locked rsigma

Add optional features as needed:

# Match the prebuilt binaries and Docker image exactly
cargo install --locked rsigma --all-features

# MCP server for AI agents (`rsigma mcp serve`)
cargo install --locked rsigma --features mcp

# Streaming over NATS JetStream
cargo install --locked rsigma --features daemon-nats

# OTLP HTTP + gRPC ingestion and detection export
cargo install --locked rsigma --features daemon-otlp

# In-process TLS/mTLS for the daemon and MCP HTTP listeners
cargo install --locked rsigma --features daemon-tls

# Windows Event Log (.evtx) input
cargo install --locked rsigma --features evtx

# Cross-rule Aho-Corasick prefilter for large rule sets
cargo install --locked rsigma --features daachorse-index

The --locked flag pins the dependency graph to the published Cargo.lock, which is what CI builds and signs. The LSP server ships in its own crate:

cargo install --locked rsigma-lsp

Build from source

For development, custom feature flags, or platforms not covered by prebuilt archives. Requires Rust 1.88.0 or newer.

git clone https://github.com/timescale/rsigma.git
cd rsigma
cargo build --release --all-features --workspace
./target/release/rsigma --help

A workspace build produces every binary: the CLI (target/release/rsigma) and the LSP server (target/release/rsigma-lsp). See the contributing guide for the full developer workflow.

Verify the install

rsigma --version
rsigma --help

You should see rsigma 0.21.0 and a list of the top-level command groups (engine, rule, backend, pipeline, config, and mcp when built with the mcp feature).

Next steps

• Run your first rule in the quick start.
• Learn the core concepts of Sigma rules, modes, and pipelines.
• Browse the full CLI reference once you are ready to dig in.