Report each detection rule's ADS (Alerting and Detection Strategy) sections, the required sections it is missing under the active config, and a scaffolded rsigma.ads.* template to complete. Accepts inline yaml or a file path.

Convert Sigma rules to backend-native queries. target is one of postgres/lynxdb/fibratus (native); when the server runs with --allow-sigma-cli, any other target is delegated to an installed sigma-cli, reaching the full pySigma backend set. Accepts inline yaml or a file/directory path, optional pipelines, format, backend options, and skip_unsupported.

Evaluate JSON events against Sigma rules and return matches. Detection-only rules use the stateless engine; collections with correlations use the stateful correlation engine. Rules via inline yaml or path; events via an inline events JSON array or an NDJSON events_path. Optional pipelines and match_detail (off/summary/full).

Apply safe auto-fixes (lowercase keys, status/level typos, duplicate removal, ...) to Sigma YAML, preserving comments and formatting. Returns the fixed YAML and applied/failed/skipped-unsafe counts. Unsafe fixes are never auto-applied. With write: true (only valid with a file path, and only when the server runs with --rules-dir) the change is persisted to disk. Optional lint_rules restricts which lint rules are fixed.

Lint Sigma rules against the specification, returning findings with lint rule id, severity, message, line, and whether an auto-fix is available. Accepts inline yaml, a file path, or a directory path.

List available conversion backends (targets) with their output formats and correlation methods. When the server runs with --allow-sigma-cli, installed sigma-cli targets are appended with engine "sigma-cli".

List the builtin processing pipelines with their priority and shape.

List the event fields referenced by Sigma rules, with provenance (which rules and source kinds reference each field). Optional pipelines are applied first so the field names match what the engine evaluates. Accepts inline yaml or a file/directory path.

Parse a Sigma condition expression (e.g. selection and not 1 of filter_*) into a parse-tree as JSON, or return a structured parse error.

Parse Sigma YAML (rules, correlations, filters; multi-document supported) into a structured AST as JSON, or return structured parse errors. Accepts inline yaml or a file path.

Resolve a processing pipeline (a builtin name like ecs_windows or a YAML file path) and report its name, priority, transformations, and dynamic sources. With resolve_sources, dynamic file/command/HTTP sources are resolved and their data keys reported.

Reverse-convert a SIEM query into a draft Sigma rule (YAML). dialect selects the source query language (lucene today, the Lucene / Elasticsearch query_string subset: field:value with wildcards, quoted phrases, /regex/, [a TO b] ranges, comparison shorthand, field:(a OR b) groups, exists, keyword terms, and AND/OR/NOT with grouping). A query carries no metadata, so pass title/id/level/status and at least one of logsource_product/category/service, which a Sigma rule requires; the result is a reviewable skeleton. Boosting, fuzzy/proximity, and non-numeric ranges are reported as errors.

Replay embedded rsigma.exemplars on Sigma detection and correlation rules and return pass/fail results. Provide exactly one of inline yaml or a path confined to --rules-dir. Optional pipelines are builtin names or confined YAML files. Shape, identity, and reference problems are configuration errors; a failed assertion is a finding, not a load error.

Propose a spec-native Sigma filter rule from false-positive and true-positive JSON event arrays. Rules come from inline yaml or a path confined to --rules-dir; select the target with rule when needed. Optional pipelines transform the target before tuning. The result includes filter YAML, field rationale, clusters, coverage, and closed before/after verification. No proposal may suppress a true positive.

Validate that Sigma rules parse and compile cleanly: parse, build the detection engine, and check correlation references. Optional pipelines, resolve_sources (resolve dynamic sources), and fail_level (error by default; warning also fails on parse warnings such as an invalid status). Accepts inline yaml or a file/directory path.