All tools / Detection engineering
RSigma | Timescale
Open timescale/rsigma on GitHub
Repository description, written by its ownerA complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
Active last commit today
Commits in 32 of the last 52 weeks
- Latest release has a checksum file but no signature
- Category
- Detection engineering
- Subcategory
- Detection Content & Signatures
- License
- MIT
- Latest release
- Release v0.25.0, Oct 19, 2026 (checksum file only, no signature)
- Stars
- 169
- GitHub repository id
- 1154854390
- Listed in
- awesome-detection-engineering (CC0-1.0)
- Last checked
- Oct 19, 2026
Security advisories
Advisories the maintainers published on GitHub. Vulnerabilities reported only elsewhere, for example in the NVD, are not included.
- GHSA-vwg6-4q3h-8pvq High Oct 19, 2026
OTLP HTTP endpoint inflates gzip bodies without a size limit - GHSA-3fh4-8r8j-8xw3 Medium Oct 19, 2026
Event fields are interpolated unescaped into enricher and webhook URLs and enricher bodies - GHSA-33jj-q567-34gj Medium Oct 19, 2026
MCP tools read arbitrary files when --rules-dir is unset - GHSA-4q23-jm32-fhr9 High Sep 30, 2026
rsigma-mcp `evaluate_events` enrichers let any MCP tool caller execute commands and send arbitrary HTTP requests - GHSA-8x2w-m5v2-phxr High Sep 30, 2026
`--rules-dir` confinement bypass lets any MCP tool caller read and mutate arbitrary files on disk
Changes seen by hackshelf
- Oct 19, 2026 First checked, status Active