Module rule_draft 

Rule drafting: turn exemplar events into a draft Sigma detection rule.

The operator feeds exemplar events (the malicious or noteworthy ones), optionally contrasted against a baseline corpus of normal traffic. This module profiles every field across the exemplars, drops volatile fields (timestamps, GUIDs, counters, high-entropy uniques), scores the rest by stability across exemplars times rarity in the baseline, infers a value form and a small Sigma modifier vocabulary per field, assembles a minimal selection, and emits a complete draft rule as standard Sigma YAML.

The draft is verified end-to-end before it is returned: the emitted YAML is parsed via rsigma_parser::parse_sigma_yaml and compiled into the real Engine, every exemplar must match (with a bounded predicate-drop relaxation and a minimum-field floor that errors instead of emitting an over-broad draft), and the baseline hit count and rate are recorded as the draft’s estimated false-positive rate.

The core is pure and deterministic: no randomness (the rule id is caller-supplied; the CLI generates a UUIDv4), and repeated runs over the same input yield byte-identical YAML. The draft uses the exemplars’ native field names, so it must be evaluated without a mapping pipeline.

This is the detection-authoring sibling of schema_discovery: discovery mines unrecognized events into schema signatures, drafting mines exemplar events into a detection rule. Both follow the same contract: the tool proposes, a human reviews and commits.

Modules

correlation

Draft temporal correlations from grouped, timed exemplar events.

Structs

DraftConfig

Tunables for a draft run. Default is a sensible starting point; the CLI exposes each as a flag.

DraftFieldReport

One profiled field in the report, ranked.

DraftReport

The result of a draft run: the rule plus the evidence behind it.

Enums

DraftError

Why a draft could not be produced.

Stability

How a field’s values behave across the exemplars.

Functions

draft_rule

Draft a Sigma detection rule from exemplar events, optionally contrasted against a baseline corpus (pass an empty slice for no baseline).