Crate sigma 

Sigma rule compilation for Calyx.

Compiles Sigma detection rules (YAML) into the secir [Template] intermediate representation, enabling Calyx to match Sigma rules against log data alongside Nuclei HTTP templates.

Sigma Format Support

• title → template ID (kebab-cased)
• logsource → preserved in tags and metadata
• detection.selection* → word/regex matchers with |contains, |endswith, |startswith modifiers
• condition → matcher condition logic (AND/OR between selections, aggregation piped expressions stored in metadata)
• level → severity mapping
• timeframe → stored in metadata for aggregation queries

Safe Defaults

• Input size: Bounded in-memory YAML parsing with strict recursion and token limits.
• Recursion depth: Restricted expression parsing depth to prevent stack overflow.
• Outbound network: No network calls are executed by this compiler crate.
• Process spawning: No process spawning or child process execution.
• Filesystem writes: Pure in-memory transformation with zero file writes.
• Credential exposure: No credentials cached or exposed during compilation.

Structs

SigmaCompiler

Sigma-to-secir compiler.