MCP Servers
timescale/rsigma
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
Our verdict
We have not reviewed timescale/rsigma yet
No one at Enterprise DNA has checked this listing against its sources. The description comes from public listings gathered automatically. Any fact below shows where it came from and when it was last checked.
From the listing
About timescale/rsigma
rsigma is a Sigma detection engineering toolkit written in Rust. It includes a parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers. The project is maintained by the timescale organization.
Best for
Security engineers building and automating Sigma detection pipelines
Use cases
- Parse and lint Sigma detection rules
- Evaluate Sigma rules against event data
- Convert Sigma rules into other detection formats
Notes
136 stars on GitHub. Last updated 2026-08-31. Licensed MIT.
Pros
- Covers the full detection workflow from parsing to correlation
- Rust-based implementation offers performance and memory safety
- Includes MCP and LSP servers for developer tooling integration
Cons
- Early-stage project with limited community traction at 136 stars
- The many components can require a significant learning curve
- Documentation and examples may still be sparse
Key facts
What we have checked
Not checked yet. Dated facts such as prices, releases and repository activity appear here once we have confirmed them from a source.
How to use
How to set it up
As the listing publishes it. We have not run this install.
Install
npx skills add timescale/sigma-rules -g -yClients the listing names (not checked here)
Claude Code, Cursor, VS Code
Install
Add timescale/rsigma to your client
No install recipe yet. We write one for Claude Code, Claude Desktop, Cursor, VS Code, Codex and ChatGPT when the server is in the official MCP registry with a package or remote address we can use.
Until then, follow the project's own README, or the setup the listing publishes under How to set it up.
Works with
What timescale/rsigma connects to
No confirmed connections yet. A product appears here when the server's registry name, repo, homepage or name ties it to that product, and a client appears when we have an install recipe for it.
Sources
Where this comes from
No sources recorded yet. Each source we check is listed here with the date we checked it.
A source shows what was published when we checked it. It does not certify security, performance or a working installation. Read our method.
Changelog
What changed
No changes recorded yet. Releases, price changes and deprecations appear here, with their dates, once we track them for this record.
Pairs with
Other entries in the index that connect to this one. Click through to see the chain.
Get the free Developer’s Field Guide
A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.
Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.