Module lint 

Built-in linter for Sigma rules, correlations, and filters.

Validates raw serde_yaml::Value documents against the Sigma specification v2.1.0 constraints — catching metadata issues that the parser silently ignores (invalid enums, date formats, tag patterns, etc.).

Usage

use rsigma_parser::lint::{lint_yaml_value, Severity};

let yaml = "title: Test\nlogsource:\n  category: test\ndetection:\n  sel:\n    field: value\n  condition: sel\n";
let value: serde_yaml::Value = serde_yaml::from_str(yaml).unwrap();
let warnings = lint_yaml_value(&value);
for w in &warnings {
    if w.severity == Severity::Error {
        eprintln!("{}", w.message);
    }
}

Structs

FileLintResult

Result of linting a single file (may contain multiple YAML documents).

Fix

A suggested fix for a lint finding.

InlineSuppressions

Parsed inline suppression directives from YAML source text.

LintConfig

Configuration for lint rule suppression and severity overrides.

LintWarning

A single lint finding.

Span

A source span (line/column, both 0-indexed).

Enums

FixDisposition

Whether a fix is safe to apply automatically or needs manual review.

FixPatch

A single patch operation within a Fix.

LintRule

Identifies which lint rule fired.

Severity

Severity of a lint finding.

Functions

apply_suppressions

Apply suppression from config and inline comments to lint warnings.

lint_yaml_directory

Lint all .yml/.yaml files in a directory recursively.

lint_yaml_directory_with_config

Lint a directory with config-based suppression.

lint_yaml_file

Lint all YAML documents in a file.

lint_yaml_file_with_config

Lint a file with config-based suppression.

lint_yaml_str

Lint a raw YAML string, returning warnings with resolved source spans.

lint_yaml_str_with_config

Lint a raw YAML string with config-based suppression.

lint_yaml_value

Lint a single YAML document value.

parse_inline_suppressions

Parse # rsigma-disable comments from raw YAML text.