sigma

Sigma rule compiler for Calyx - part of the Santh security research ecosystem.

What it does

sigma parses Sigma detection rules written in YAML and compiles them into secir intermediate representation (secir::Template).

Key capabilities include:

• Parsing Sigma YAML fields: title, logsource, detection, condition, level, and timeframe.
• Mapping detection selections to regex and word matchers with field modifiers (contains, endswith, startswith, base64, cased, re).
• Compiling complex condition expressions into matcher logic and aggregation pipelines.
• Preserving logsource category, product, and service metadata.

Quick start

Add sigma to your Cargo.toml:

[dependencies]
sigma = { path = "../sigma" }

Compile a Sigma YAML rule into a secir::Template:

use sigma::SigmaCompiler;

let yaml = r#"
title: Suspicious Process Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 'powershell -encodedcommand'
  condition: selection
level: high
"#;

let compiler = SigmaCompiler::new();
let template = compiler.compile(yaml).expect("failed to compile Sigma rule");
assert_eq!(template.id, "suspicious-process-execution");

When to use / when not

When to use:

• Compiling standard Sigma detection rules into secir templates for Calyx scanning.
• Translating Windows, Linux, or application log detection patterns into structured matcher logic.

When not to use:

• Direct log file ingestion without a rule compilation step.
• Non-Sigma telemetry formats (use dedicated parsers or Nuclei template compilers).

Compared to alternatives

• pySigma: Python-based reference implementation. sigma is a native Rust compiler optimized for integration with secir and Calyx engine pipelines without Python interpreter overhead.
• sigma-cli: CLI tool for multi-target conversion. sigma focuses on fast in-memory compilation into the standard Santh IR format.

How it fits in Santh

sigma sits in the scanner layer of the Santh ecosystem:

• Consumes Sigma rule definitions (YAML).
• Emits standard secir::Template data structures.
• Feeds secir IR into calyx for high-throughput security event scanning and pattern matching.

Contributing

Contributions are welcome. Please ensure all tests pass and cargo run -p santh-conform -- check libs/scanner/sigma runs clean before submitting a PR.

License

Licensed under either of:

• Apache License, Version 2.0 (LICENSE-APACHE)
• MIT License (LICENSE-MIT)