Rustinel 1.5.0: correlated detection, stronger fidelity Rustinel 1.5 makes Sigma detection more capable and the live sensor pipeline more resilient. RSigma is now the single Sigma engine, with corr...

View more about this event at Linux Security Summit Europe 2026

A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab: - timescale/rsigma

A curated list of Rust code and resources. Contribute to rust-unofficial/awesome-rust development by creating an account on GitHub.

A tour of what one Rust binary does for detection engineering today, and where it is headed

Author(s) Mostafa Moradian SEP Type New Detection Logic (correlation types, aggregation functions) (Secondary: New Rule Fields, since it adds the window and gap attributes to the correlation sectio...

Author(s) Mostafa Moradian SEP Type New Detection Logic (correlation types, aggregation functions) (Secondary: New Rule Fields, since it adds the window and gap attributes to the correlation sectio...

SEP: Rule-Level Specification Version Declaration Relates to: sigma-specification SEP #212 (Array Matching in Sigma), sigma-specification Discussion #106. Spun out of SEP #212. The mechanism was ra...

Open-source endpoint detection engine for Windows and Linux using ETW, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts. - Karib0u/rustinel

Inspired by @mostafa's work in RSigma, external data sources would also be useful in pySigma's conversion use case. This should be implemented as new processing transformations for different types ...

Sigma rule specification. Contribute to SigmaHQ/sigma-specification development by creating an account on GitHub.

TL;DR RSigma v0.13.0 is the "post-evaluation enrichment, server-side TLS, and field observability" release: Post-evaluation enrichment between engine.evaluate() and the sinks: four primitives (tem...

TL;DR RSigma v0.12.0 is the

TL;DR RSigma v0.10.0 is the "dynamic pipelines" release: Dynamic Sigma Pipelines: declare HTTP, command, file, and NATS sources inside pipeline YAML, with template expansion, include directives, T...

TL;DR RSigma v0.9.0 is one of the largest releases yet: Production-grade NATS JetStream with at-least-once delivery, authentication and TLS, dead-letter queues, replay from offset or timestamp, co...

How RSigma turns 3,800+ community detection rules into SQL queries for TimescaleDB

TL;DR RSigma v0.8.0 is the "rule conversion" release. A new rsigma-convert crate transforms Sigma rules into backend-native query strings through a pluggable Backend trait. The first production bac...

Turning Four Routine Okta Detections into One Critical Alert

TL;DR RSigma v0.7.0 is the "any log format" release. The evaluation engine now operates on a generic Event trait instead of raw JSON, a new rsigma-runtime library crate decouples the streaming pipe...

Introducing Helr: a Rust-based generic HTTP API log collector that turns YAML config into a resilient log pipeline

Introducing RSigma: a Rust toolkit for evaluating Sigma detection rules against JSON events without a SIEM

How to create and monitor GCP service accounts as canary tokens