rsigma 0.17.0

CLI for parsing, validating, linting and evaluating Sigma detection rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

mod backtest;
mod convert;
mod coverage;
#[cfg(feature = "daemon")]
mod daemon;
mod eval;
mod eval_stream;
mod fields;
mod lint;
#[cfg(feature = "mcp")]
mod mcp;
mod migrate_sources;
mod navigator;
mod parse;
// Shared serializable report shapes for the detection-as-code `rule` commands:
// `backtest`/`coverage` produce them, `scorecard` consumes them.
pub(crate) mod reports;
// `pipeline resolve` needs the async runtime + source resolver, which only
// ship with the `daemon` feature.
#[cfg(feature = "daemon")]
mod resolve;
mod scorecard;
// Delegation to an external sigma-cli for non-native conversion targets.
mod sigma_cli;
mod status;
mod tail;
mod tap;
mod validate;
mod visibility;

pub(crate) use backtest::{BacktestArgs, apply_backtest_config, cmd_backtest};
pub(crate) use convert::{
    ConvertArgs, ListFormatsArgs, cmd_convert, cmd_list_formats, cmd_list_targets,
};
pub(crate) use coverage::{CoverageArgs, apply_coverage_config, cmd_coverage};
#[cfg(feature = "daemon")]
pub(crate) use daemon::{DaemonArgs, cmd_daemon, parse_input_format};
pub(crate) use eval::{EvalArgs, apply_eval_config, cmd_eval};
pub(crate) use fields::{FieldsArgs, cmd_fields};
pub(crate) use lint::{LintArgs, LintCounts, cmd_lint};
#[cfg(feature = "mcp")]
pub(crate) use mcp::{McpCommands, dispatch_mcp};
pub(crate) use migrate_sources::{MigrateSourcesArgs, cmd_migrate_sources};
pub(crate) use parse::{ConditionArgs, ParseArgs, StdinArgs, cmd_condition, cmd_parse, cmd_stdin};
#[cfg(feature = "daemon")]
pub(crate) use resolve::{ResolveArgs, cmd_resolve};
pub(crate) use scorecard::{ScorecardArgs, apply_scorecard_config, cmd_scorecard};
pub(crate) use status::{StatusArgs, cmd_status};
pub(crate) use tail::{TailArgs, cmd_tail};
pub(crate) use tap::{TapArgs, cmd_tap};
pub(crate) use validate::{ValidateArgs, cmd_validate};
pub(crate) use visibility::{VisibilityArgs, apply_visibility_config, cmd_visibility};