# sigma - Technical Spec
## Overview
Sigma rule compilation for Calyx. Compiles Sigma detection rules (YAML) into the secir [`Template`] intermediate representation, enabling Calyx to match Sigma rules against log data alongside Nuclei HTTP templates. # Sigma Format Support - `title` → template ID (kebab-cased) - `logsource` → preserved in tags and metadata - `detection.selection*` → word/regex matchers with `|contains`, `|endswith`, `|startswith` modifiers - `condition` → matcher condition logic (AND/OR between selections, aggregation piped expressions stored in metadata) - `level` → severity mapping - `timeframe` → stored in metadata for aggregation queries
## Architecture
The crate is organized into the following public modules:
- (see source for module layout)
## Guarantees
- `#![forbid(unsafe_code)]` where applicable; see `src/lib.rs` for the exact lint preamble.
- All public types have doc comments.
- Error messages are actionable where applicable.
## Public API Summary
Key entry points are exported from `src/lib.rs` via `pub mod` and `pub use` re-exports.
Consult the module-level documentation in each source file for function signatures and usage examples.
## Error Handling
- Standard `Result` / error types.