suggest_rule
Find existing Sigma rules most relevant to your detection query. Scores rules by term matches in title, tags, and description to return the best candidates.
Instructions
Suggest existing installed Sigma rules relevant to a free-text query.
Unlike get_hayabusa_rules (exact case-insensitive substring match, returns every match), this scores each rule by how many of query's terms it matches -- a title match outweighs a tags match, which outweighs a description-only match -- and returns only the top max_suggestions candidates, most relevant first. Use this for "is there already a rule for X" / "which existing rule is closest to Y"; it finds and ranks existing rules, it does not write or generate new ones.
Args: query: Free-text description of the detection you're looking for, e.g. "mimikatz credential dumping". Required, non-empty. technique_id: Optional ATT&CK technique ID (e.g. "T1003.001") to restrict candidates to rules already tagged with that technique before ranking. max_suggestions: Maximum number of ranked candidates to return (default 10). rules_dir: Optional path to a rules directory. Defaults to the "rules" directory next to the resolved hayabusa binary.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| rules_dir | No | ||
| technique_id | No | ||
| max_suggestions | No |