Module emit 

Emit a parsed Sigma rule back to canonical Sigma YAML.

This is the inverse of parse_sigma_yaml: it turns a SigmaRule (or a SigmaCollection of detection rules) back into standard Sigma YAML. Parsing then emitting then parsing again yields an equal AST for the detection-rule shapes the parser produces (field matching with modifiers, value lists, keyword blocks, field[any]/field[all] array blocks, boolean and quantified conditions, and all standard metadata).

The emitter is deterministic: mapping-shaped collections (named detections, logsource custom fields, custom attributes) are emitted in sorted key order, so the same rule always produces byte-identical YAML. Detection value order and condition order are preserved as-is.

Value scalars are rendered in Sigma’s single-quote convention, with literal *, ?, and \ escaped so a re-parse reproduces the same SigmaString wildcard structure.

Functions

emit_collection_yaml

Emit every detection rule in a collection, separated by --- documents.

emit_rule_yaml

Emit a single detection SigmaRule as canonical Sigma YAML.