rsigma-eval 0.22.0

Evaluator for Sigma detection and correlation rules — match rules against events
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

title: 'Draft: totp (factor)'
name: slot_totp
id: 00000000-0000-4000-8000-000000000001
status: experimental
description: 'TODO: describe what this rule detects and why it matters.'
author: 'TODO: your name'
date: 2026-09-04
logsource:
    product: todo
detection:
    selection:
        factor: totp
        kind: reset
        reset_reason: recovery
    condition: selection
falsepositives:
    - 'TODO: list known benign triggers.'
level: medium
---
title: 'Draft: 64512 (asn)'
name: slot_64512
id: 00000000-0000-4000-8000-000000000002
status: experimental
description: 'TODO: describe what this rule detects and why it matters.'
author: 'TODO: your name'
date: 2026-09-04
logsource:
    product: todo
detection:
    selection:
        asn: 64512
        kind: session
        new_asn: true
        session_type: web
    condition: selection
falsepositives:
    - 'TODO: list known benign triggers.'
level: medium
---
title: Draft temporal correlation
id: 00000000-0000-4000-8000-000000000003
status: experimental
correlation:
    type: temporal_ordered
    rules:
        - slot_totp
        - slot_64512
    group-by:
        - user
    timespan: 30s
    condition:
        gte: 2
custom_attributes:
    rsigma.exemplars:
        - name: 'observed group g2'
          expect: match
          events:
              - offset: 0s
                event:
                    factor: totp
                    kind: reset
                    reset_reason: recovery
                    user: bob
              - offset: 20s
                event:
                    asn: 64512
                    kind: session
                    new_asn: true
                    session_type: web
                    user: bob
level: medium