sigma

Sigma rule compiler for Calyx - part of the Santh security research ecosystem.

What it does

sigma parses Sigma detection rules written in YAML and compiles them into secir intermediate representation (secir::Template).

Key capabilities include:

Parsing Sigma YAML fields: title, logsource, detection, condition, level, and timeframe.
Mapping detection selections to regex and word matchers with field modifiers (contains, endswith, startswith, base64, cased, re).
Compiling complex condition expressions into matcher logic and aggregation pipelines.
Preserving logsource category, product, and service metadata.

Quick start

Add sigma to your Cargo.toml:

[dependencies]
sigma = { path = "../sigma" }

Compile a Sigma YAML rule into a secir::Template:

use sigma::SigmaCompiler;

let yaml = r#"
title: Suspicious Process Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 'powershell -encodedcommand'
  condition: selection
level: high
"#;

let compiler = SigmaCompiler::new();
let template = compiler.compile(yaml).expect("failed to compile Sigma rule");
assert_eq!(template.id, "suspicious-process-execution");

When to use / when not

When to use:

Compiling standard Sigma detection rules into secir templates for Calyx scanning.
Translating Windows, Linux, or application log detection patterns into structured matcher logic.

When not to use:

Direct log file ingestion without a rule compilation step.
Non-Sigma telemetry formats (use dedicated parsers or Nuclei template compilers).

Compared to alternatives

pySigma: Python-based reference implementation. sigma is a native Rust compiler optimized for integration with secir and Calyx engine pipelines without Python interpreter overhead.
sigma-cli: CLI tool for multi-target conversion. sigma focuses on fast in-memory compilation into the standard Santh IR format.

How it fits in Santh

sigma sits in the scanner layer of the Santh ecosystem:

Consumes Sigma rule definitions (YAML).
Emits standard secir::Template data structures.
Feeds secir IR into calyx for high-throughput security event scanning and pattern matching.

Contributing

Contributions are welcome. Please ensure all tests pass and cargo run -p santh-conform -- check libs/scanner/sigma runs clean before submitting a PR.

License

Licensed under either of:

Apache License, Version 2.0 (LICENSE-APACHE)
MIT License (LICENSE-MIT)

santh-sigma 0.1.4