santh-sigma 0.1.4

Sigma rule compiler for security research
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

# sigma

![Status: alpha](https://img.shields.io/badge/status-alpha-blue.svg)

Sigma rule compiler for Calyx - part of the Santh security research ecosystem.

## What it does

`sigma` parses Sigma detection rules written in YAML and compiles them into `secir` intermediate representation (`secir::Template`).

Key capabilities include:
- Parsing Sigma YAML fields: `title`, `logsource`, `detection`, `condition`, `level`, and `timeframe`.
- Mapping detection selections to regex and word matchers with field modifiers (`contains`, `endswith`, `startswith`, `base64`, `cased`, `re`).
- Compiling complex condition expressions into matcher logic and aggregation pipelines.
- Preserving logsource category, product, and service metadata.

## Quick start

Add `sigma` to your `Cargo.toml`:

```toml
[dependencies]
sigma = { path = "../sigma" }
```

Compile a Sigma YAML rule into a `secir::Template`:

```rust
use sigma::SigmaCompiler;

let yaml = r#"
title: Suspicious Process Execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 'powershell -encodedcommand'
  condition: selection
level: high
"#;

let compiler = SigmaCompiler::new();
let template = compiler.compile(yaml).expect("failed to compile Sigma rule");
assert_eq!(template.id, "suspicious-process-execution");
```

## When to use / when not

**When to use:**
- Compiling standard Sigma detection rules into `secir` templates for Calyx scanning.
- Translating Windows, Linux, or application log detection patterns into structured matcher logic.

**When not to use:**
- Direct log file ingestion without a rule compilation step.
- Non-Sigma telemetry formats (use dedicated parsers or Nuclei template compilers).

## Compared to alternatives

- **`pySigma`**: Python-based reference implementation. `sigma` is a native Rust compiler optimized for integration with `secir` and Calyx engine pipelines without Python interpreter overhead.
- **`sigma-cli`**: CLI tool for multi-target conversion. `sigma` focuses on fast in-memory compilation into the standard Santh IR format.

## How it fits in Santh

`sigma` sits in the scanner layer of the Santh ecosystem:
- Consumes Sigma rule definitions (YAML).
- Emits standard `secir::Template` data structures.
- Feeds `secir` IR into `calyx` for high-throughput security event scanning and pattern matching.

## Contributing

Contributions are welcome. Please ensure all tests pass and `cargo run -p santh-conform -- check libs/scanner/sigma` runs clean before submitting a PR.

## License

Licensed under either of:
- Apache License, Version 2.0 (`LICENSE-APACHE`)
- MIT License (`LICENSE-MIT`)