What it does
An MCP server for working with Sigma detection rules. It can author, lint, validate and convert rules, evaluate and explain detections against log events, and inspect correlation state. It is part of the RSigma detection engineering toolkit.
Use cases
- 01Lint and validate a new Sigma rule
- 02Convert a Sigma rule to another query format
- 03Test why a rule did or did not match a log event