Feature Flags

rsigma is a workspace of nine library crates (rsigma-parser, rsigma-ir, rsigma-eval, rsigma-convert, rsigma-runtime, rsigma-mcp, rsigma-cli, rsigma-lsp, rstix), several of which expose Cargo features that gate optional dependencies and code paths. This page documents every feature, its default state, what it pulls in, and how to enable it when building from source.

The CLI ships with sensible defaults; the precompiled release archives and the GHCR Docker image are built with --all-features, so every feature documented here is available out of the box.

rsigma-cli

The crate that produces the rsigma binary.

rsigma-eval

The detection and correlation engine. Used as a library and re-exported by rsigma-cli.

rsigma-runtime

The streaming runtime (event sources, sinks, daemon plumbing, dynamic pipelines).

rsigma-convert

The conversion engine. Used as a library and re-exported by rsigma-cli.

rsigma-parser

rsigma-mcp

The Model Context Protocol server library. Gated into the CLI by the mcp feature above.

rstix

STIX 2.1 library crate. Data Model + Serialization is complete with serde (default): typed objects, bundle parse/stream, advisory Bundle::validate, wire MUST at parse (DD-DM-001), and wire conformance (STIX 2.1). Pattern Engine is complete with pattern. Validation Pipeline is complete with validate (all twelve checks, conformance corpus, per-code diagnostic coverage). Graph + Marking + Store are complete with graph, marking, store, and store-fs. TAXII Client is available with taxii (see TAXII Client).

Without the serde feature, only Core Foundation APIs are available (typed IDs, vocab tables, programmatic model types; no bundle parsing). Enable pattern for the Pattern Engine (implies serde). Enable validate for the Validation Pipeline (cargo build -p rstix --features validate).

Building with features

Cargo install

# Default: daemon + everything that ships with it, no extras.
cargo install --locked rsigma

# Recommended for production: daemon + TLS + NATS + OTLP + EVTX + cross-rule AC.
cargo install --locked rsigma --features daemon-tls,daemon-nats,daemon-otlp,evtx,daachorse-index

# Match the prebuilt release archives and Docker image exactly.
cargo install --locked rsigma --all-features

Local development

# Workspace build with every feature on.
cargo build --release --all-features --workspace

# Run just the `engine daemon` tests with the NATS feature.
cargo test -p rsigma-cli --features daemon-nats

CI coverage

The repo’s ci.yml runs cargo check, MSRV, cargo clippy, cargo test, cargo doc, and the coverage job against --all-features, plus the cross-platform cargo test --all-features matrix on Ubuntu, macOS, and Windows. A separate job builds rsigma-parser and rsigma-eval for wasm32-unknown-unknown with --no-default-features and then instantiates a linked module in a JavaScript-free runtime (Wasmtime). There is no general per-feature opt-in matrix: every other gated dependency listed above is built on every push, but no job exercises, for example, daemon-nats in isolation.

If a feature combination matters to you (and especially if a build with --no-default-features or a single optional feature is part of your downstream pipeline) and CI does not currently exercise it, file an issue so a job can be added.

Detecting features at runtime

The binary’s --help enumerates only the flags compiled in. If a NATS flag is missing from rsigma engine daemon --help, the binary was built without daemon-nats. Equivalent shells for the other gated surfaces:

# daachorse-index?
rsigma engine daemon --help | grep -q cross-rule-ac && echo on || echo off

# evtx?
echo "" | rsigma engine eval -r /dev/null -e @/dev/null --input-format json 2>&1 | grep -q "evtx" || echo "evtx feature not required for JSON inputs"

There is no first-class rsigma --features introspection flag. Use --help presence checks as above.

See also

• Installation for prebuilt binaries (which use --all-features) and source builds.
• Performance Tuning for when daachorse-index actually pays off.
• NATS Streaming, OTLP Integration, Input Formats for what each feature gates in practice.