[package]
edition = "2024"
rust-version = "1.88.0"
name = "rsigma"
version = "0.15.0"
build = false
autolib = false
autobins = false
autoexamples = false
autotests = false
autobenches = false
description = "CLI for parsing, validating, linting and evaluating Sigma detection rules"
homepage = "https://github.com/timescale/rsigma"
readme = "README.md"
license = "MIT"
repository = "https://github.com/timescale/rsigma"
[features]
cef = ["rsigma-runtime/cef"]
daachorse-index = [
"rsigma-eval/daachorse-index",
"rsigma-runtime?/daachorse-index",
]
daemon = [
"rsigma-runtime",
"tokio",
"axum",
"async-trait",
"prometheus",
"notify",
"rusqlite",
"tower-http",
]
daemon-nats = [
"daemon",
"rsigma-runtime/nats",
"async-nats",
"tokio-stream",
"time",
]
daemon-otlp = [
"daemon",
"rsigma-runtime/otlp",
"prost",
"tonic",
"flate2",
"tokio-stream",
]
daemon-tls = [
"daemon",
"dep:rustls",
"dep:tokio-rustls",
"dep:rustls-pki-types",
"dep:x509-parser",
"dep:hyper",
"dep:hyper-util",
"dep:tower-service",
]
default = ["daemon"]
evtx = ["rsigma-runtime/evtx"]
logfmt = ["rsigma-runtime/logfmt"]
[[bin]]
name = "rsigma"
path = "src/main.rs"
[[test]]
name = "cli_config"
path = "tests/cli_config.rs"
[[test]]
name = "cli_convert"
path = "tests/cli_convert.rs"
[[test]]
name = "cli_daemon"
path = "tests/cli_daemon.rs"
[[test]]
name = "cli_daemon_dynamic"
path = "tests/cli_daemon_dynamic.rs"
[[test]]
name = "cli_daemon_enrichment"
path = "tests/cli_daemon_enrichment.rs"
[[test]]
name = "cli_daemon_fields_observer"
path = "tests/cli_daemon_fields_observer.rs"
[[test]]
name = "cli_daemon_http"
path = "tests/cli_daemon_http.rs"
[[test]]
name = "cli_daemon_nats"
path = "tests/cli_daemon_nats.rs"
[[test]]
name = "cli_daemon_otlp"
path = "tests/cli_daemon_otlp.rs"
[[test]]
name = "cli_daemon_tls"
path = "tests/cli_daemon_tls.rs"
[[test]]
name = "cli_deprecation"
path = "tests/cli_deprecation.rs"
[[test]]
name = "cli_eval"
path = "tests/cli_eval.rs"
[[test]]
name = "cli_fields"
path = "tests/cli_fields.rs"
[[test]]
name = "cli_lint"
path = "tests/cli_lint.rs"
[[test]]
name = "cli_migrate_sources"
path = "tests/cli_migrate_sources.rs"
[[test]]
name = "cli_output_format"
path = "tests/cli_output_format.rs"
[[test]]
name = "cli_parse"
path = "tests/cli_parse.rs"
[[test]]
name = "cli_sources_deprecation"
path = "tests/cli_sources_deprecation.rs"
[[test]]
name = "cli_validate"
path = "tests/cli_validate.rs"
[dependencies.arc-swap]
version = "1"
[dependencies.async-nats]
version = "0.49"
optional = true
[dependencies.async-trait]
version = "0.1"
optional = true
[dependencies.axum]
version = "0.8"
features = ["json"]
optional = true
[dependencies.chrono]
version = "0.4"
features = [
"std",
"now",
]
default-features = false
[dependencies.clap]
version = "4"
features = [
"derive",
"env",
]
[dependencies.dirs]
version = "6"
[dependencies.flate2]
version = "1"
optional = true
[dependencies.humantime]
version = "2"
[dependencies.hyper]
version = "1"
features = [
"server",
"http1",
"http2",
]
optional = true
[dependencies.hyper-util]
version = "0.1"
features = [
"server-auto",
"tokio",
"service",
]
optional = true
[dependencies.jaq-core]
version = "3.0"
[dependencies.jaq-json]
version = "2.0"
[dependencies.jaq-std]
version = "3.0"
[dependencies.jsonschema]
version = "0.46"
[dependencies.notify]
version = "8.2"
optional = true
[dependencies.prometheus]
version = "0.14"
optional = true
default-features = false
[dependencies.prost]
version = "0.14"
optional = true
[dependencies.rsigma-convert]
version = "0.15.0"
[dependencies.rsigma-eval]
version = "0.15.0"
features = ["parallel"]
[dependencies.rsigma-parser]
version = "0.15.0"
[dependencies.rsigma-runtime]
version = "0.15.0"
optional = true
[dependencies.rusqlite]
version = "0.39"
features = ["bundled"]
optional = true
[dependencies.rustls]
version = "0.23"
features = [
"aws_lc_rs",
"std",
"tls12",
"logging",
]
optional = true
default-features = false
[dependencies.rustls-pki-types]
version = "1.9"
features = ["std"]
optional = true
[dependencies.schemars]
version = "1"
[dependencies.serde]
version = "1"
features = ["derive"]
[dependencies.serde_ignored]
version = "0.1"
[dependencies.serde_json]
version = "1"
[dependencies.serde_json_path]
version = "0.7.2"
[dependencies.time]
version = "0.3"
optional = true
[dependencies.tokio]
version = "1"
features = ["full"]
optional = true
[dependencies.tokio-rustls]
version = "0.26"
features = [
"aws_lc_rs",
"tls12",
"logging",
]
optional = true
default-features = false
[dependencies.tokio-stream]
version = "0.1"
optional = true
[dependencies.tonic]
version = "0.14"
features = ["gzip"]
optional = true
[dependencies.tower-http]
version = "0.6"
features = ["trace"]
optional = true
[dependencies.tower-service]
version = "0.3"
optional = true
[dependencies.tracing]
version = "0.1"
[dependencies.tracing-subscriber]
version = "0.3"
features = [
"json",
"env-filter",
]
[dependencies.ureq]
version = "3"
[dependencies.x509-parser]
version = "0.18"
optional = true
[dependencies.yaml_serde]
version = "0.10"
[dependencies.yamlpatch]
version = "1.25"
[dependencies.yamlpath]
version = "1.25"
[dev-dependencies.assert_cmd]
version = "2.2.2"
[dev-dependencies.async-nats]
version = "0.49"
[dev-dependencies.bytes]
version = "1"
[dev-dependencies.flate2]
version = "1"
[dev-dependencies.futures]
version = "0.3"
[dev-dependencies.insta]
version = "1.46"
[dev-dependencies.opentelemetry-proto]
version = "0.32"
features = [
"gen-tonic",
"logs",
"with-serde",
]
default-features = false
[dev-dependencies.predicates]
version = "3.1.4"
[dev-dependencies.prost]
version = "0.14"
[dev-dependencies.rcgen]
version = "0.14"
features = [
"aws_lc_rs",
"pem",
]
default-features = false
[dev-dependencies.rusqlite]
version = "0.39"
features = ["bundled"]
[dev-dependencies.rustls]
version = "0.23"
features = [
"aws_lc_rs",
"std",
"tls12",
]
default-features = false
[dev-dependencies.rustls-pki-types]
version = "1.9"
features = ["std"]
[dev-dependencies.serde_json]
version = "1"
[dev-dependencies.tempfile]
version = "3.25.0"
[dev-dependencies.testcontainers]
version = "0.27"
[dev-dependencies.testcontainers-modules]
version = "0.15"
features = ["nats"]
[dev-dependencies.time]
version = "0.3"
[dev-dependencies.tokio]
version = "1"
features = ["full"]
[dev-dependencies.tokio-rustls]
version = "0.26"
features = [
"aws_lc_rs",
"tls12",
]
default-features = false
[dev-dependencies.wiremock]
version = "0.6"