timescale/rsigma

Overview

rsigma is a Sigma detection engineering toolkit written in Rust. It includes a parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers. The project is maintained by the timescale organization.

Best for

Best for
Security engineers building and automating Sigma detection pipelines

Use cases

• Parse and lint Sigma detection rules
• Evaluate Sigma rules against event data
• Convert Sigma rules into other detection formats

How to use

Tested with

Claude Code, Cursor, VS Code

Notes

rsigma is a Sigma detection engineering toolkit written in Rust. It includes a parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers. The project is maintained by the timescale organization.

136 stars on GitHub. Last updated 2026-08-31. Licensed MIT.

Use cases

• Parse and lint Sigma detection rules
• Evaluate Sigma rules against event data
• Convert Sigma rules into other detection formats

Pros

• Covers the full detection workflow from parsing to correlation
• Rust-based implementation offers performance and memory safety
• Includes MCP and LSP servers for developer tooling integration

Cons

• Early-stage project with limited community traction at 136 stars
• The many components can require a significant learning curve
• Documentation and examples may still be sparse

Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.