rsigma

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

rsigma

Use rsigma to run Sigma rules. Author the YAML with the sigma-rules skill (

npx skills add timescale/sigma-rules -g -y

). This skill covers the toolchain: command names, when to call MCP versus the CLI, and which command fits the job.

Flag tables and option lists live at rsigma.io. Read them when you need a flag. Do not invent flags, and do not quote lint or auto-fix counts. The linting guide is the catalogue.

使用 rsigma 运行 Sigma 规则。使用 sigma-rules skill 编写 YAML（

npx skills add timescale/sigma-rules -g -y

）。该 skill 涵盖整个工具链：命令名称、何时调用 MCP 而非 CLI，以及适合具体任务的命令。

flag 表和选项列表位于 rsigma.io。需要使用某个 flag 时请查阅相关文档。不要杜撰 flag，也不要引用 lint 或自动修复的数量。lint 指南是规则目录。

Command names

命令名称

The CLI is noun-led. These old top-level forms do not exist:

Do not run	Run instead
`rsigma eval`	`rsigma engine eval`
`rsigma lint`	`rsigma rule lint`
`rsigma validate`	`rsigma rule validate`
`rsigma daemon`	`rsigma engine daemon`

Groups:

Group	Use it for
`engine`	Evaluate events, explain a miss, classify schemas, and run or inspect the daemon ( `eval` , `explain` , `classify` , `discover-schemas` , `status` , `tap` , `tail` , `daemon` )
`rule`	Lint, validate, draft, tune, test exemplars, backtest, and reverse-convert
`backend`	Convert rules to a query ( `convert` , `targets` , `formats` )
`pipeline`	See how a pipeline rewrites a rule ( `diff` ) and dry-run dynamic sources ( `resolve` )
`mcp`	Serve the toolchain to an agent ( `serve` )
`config`	Scaffold and inspect `rsigma.yaml`

engine daemon

and

pipeline resolve

need a build with the

daemon

feature.

mcp serve

needs the

mcp

feature. Release binaries and the Docker image include both.

rsigma --features

prints what this binary was built with.

Full tree: CLI reference.

CLI 采用名词优先的命名方式。以下旧的顶层形式已不存在：

不要运行	改为运行
`rsigma eval`	`rsigma engine eval`
`rsigma lint`	`rsigma rule lint`
`rsigma validate`	`rsigma rule validate`
`rsigma daemon`	`rsigma engine daemon`

命令组：

命令组	用途
`engine`	评估事件、解释未命中原因、对 schema 进行分类，以及运行或检查 daemon（ `eval` 、 `explain` 、 `classify` 、 `discover-schemas` 、 `status` 、 `tap` 、 `tail` 、 `daemon` ）
`rule`	lint、validate、起草、调优、测试 exemplars、回测以及反向转换规则
`backend`	将规则转换为查询（ `convert` 、 `targets` 、 `formats` ）
`pipeline`	查看 pipeline 如何重写规则（ `diff` ），以及对动态源执行 dry-run（ `resolve` ）
`mcp`	向 Agent 提供工具链（ `serve` ）
`config`	生成并检查 `rsigma.yaml`

engine daemon

和

pipeline resolve

需要包含

daemon

feature 的构建版本。

mcp serve

需要

mcp

feature。release 二进制文件和 Docker 镜像均包含这两项 feature。

rsigma --features

会打印当前二进制文件构建时包含的 feature。

完整命令树：CLI 参考。

Prefer MCP when it is connected

已连接时优先使用 MCP

rsigma mcp serve

is already connected, call its tools. They return JSON (

ok

, findings, matches) and you do not scrape CLI text. If it is not connected, use the CLI commands in workflows.md.

Start a local server only when the user wants the agent wired up:

bash

rsigma mcp serve --rules-dir rules/

Always pass

--rules-dir

. Without it, path arguments are unconfined,

fix_rules

cannot write, and

--http

refuses to start.

Point

--daemon-url

at a running daemon when the task is live triage (incidents, silences, dispositions). Those tools stay off until that URL is set. Writes stay behind

--allow-operate-writes

. Details: MCP server guide.

如果

rsigma mcp serve

已经连接，请调用其工具。这些工具会返回 JSON（

ok

、findings、matches），无需抓取 CLI 文本。如果尚未连接，请使用 workflows.md 中的 CLI 命令。

仅当用户希望接入 Agent 时，才启动本地 server：

bash

rsigma mcp serve --rules-dir rules/

始终传入

--rules-dir

。如果不传，路径参数将不受限制，

fix_rules

无法写入，并且

--http

会拒绝启动。

在实时分诊（incidents、silences、dispositions）场景下，将

--daemon-url

指向正在运行的 daemon。设置该 URL 前，这些工具将保持禁用。写操作仍受

--allow-operate-writes

控制。详情：MCP server 指南。

Which command

如何选择命令

One-shot check against a file or a few events:
```
engine eval
```
. A long-running process with reload, metrics, and sinks:
```
engine daemon
```
.
A rule from exemplar events (optional baseline, or
```
--groups
```
for a temporal correlation):
```
rule draft
```
. A rule the user already described in words: write the YAML with sigma-rules, then lint and evaluate it here.
A noisy rule with known false positives and true positives that must still fire:
```
rule tune
```
.
Embedded
```
rsigma.exemplars
```
:
```
rule test
```
. A separate corpus and expectations file:
```
rule backtest
```
.
Why a rule missed:
```
engine explain
```
. How a pipeline rewrote fields:
```
pipeline diff
```
.

The write-lint-evaluate-convert loop, with the MCP tool beside each CLI command, is in workflows.md.

对文件或少量事件执行一次性检查：
```
engine eval
```
。用于包含 reload、metrics 和 sinks 的长期运行进程：
```
engine daemon
```
。
根据 exemplar events 起草规则（可选 baseline，或为 temporal correlation 使用
```
--groups
```
）：
```
rule draft
```
。对于用户已经用文字描述的规则：使用 sigma-rules 编写 YAML，然后在此处进行 lint 和评估。
已知 false positives 和 true positives、且仍必须触发的噪声规则：
```
rule tune
```
。
嵌入在
```
rsigma.exemplars
```
中的 exemplars：
```
rule test
```
。独立的 corpus 和 expectations 文件：
```
rule backtest
```
。
规则未命中的原因：
```
engine explain
```
。pipeline 重写字段的方式：
```
pipeline diff
```
。

完整的写入—lint—评估—转换循环，以及每个 CLI 命令对应的 MCP 工具，请参阅 workflows.md。

Convert

转换

Native targets run inside rsigma. Anything else is delegated to an installed sigma-cli.

bash

rsigma backend targets
rsigma backend convert -t postgres rules/
rsigma backend convert -t splunk rules/

Native targets are

postgres

(

postgresql

pg

lynxdb

, and

fibratus

, plus a backend-neutral

test

target that is not a deployment backend.

backend targets

is the live list. Delegated conversion needs

sigma

PATH

(override with

RSIGMA_SIGMA_CLI

). The Docker image has no Python, so delegation is a local-binary feature. On MCP,

convert_rules

delegates only when the server was started with

--allow-sigma-cli

. Builtin pipeline names (

ecs_windows

fibratus_windows

sysmon

) are not translated for delegated targets. Pass a sigma-cli pipeline name or a YAML path.

See backend convert and sigma-cli delegation.

原生 targets 在 rsigma 内运行。其他 targets 均委托给已安装的 sigma-cli。

bash

rsigma backend targets
rsigma backend convert -t postgres rules/
rsigma backend convert -t splunk rules/

原生 targets 包括

postgres

（

postgresql

、

pg

）、

lynxdb

和

fibratus

，以及与 backend 无关、不能作为部署 backend 的

test

target。

backend targets

会显示实时列表。委托转换要求

sigma

位于

PATH

中（可通过

RSIGMA_SIGMA_CLI

覆盖）。Docker 镜像不包含 Python，因此 delegation 需要本地二进制文件。在 MCP 上，只有 server 使用

--allow-sigma-cli

启动时，

convert_rules

才会执行 delegation。对于 delegated targets，内置 pipeline 名称（

ecs_windows

、

fibratus_windows

、

sysmon

）不会被转换。请传入 sigma-cli pipeline 名称或 YAML 路径。

请参阅 backend convert 和 sigma-cli delegation。