Rsigma

What timescale/rsigma MCP server does

The timescale/rsigma MCP server brings RSigma’s Sigma workflow into MCP-compatible agent clients. It covers rule creation and maintenance tasks, including drafting rules from example and baseline events, tuning rules against false positives, linting, validation, conversion, and documentation metadata. It also exposes detection analysis functions that help explain why a rule matched or failed to match an event and inspect active correlation state.

RSigma is built around the Sigma detection standard. Its broader toolkit includes a parser, evaluation engine, streaming runtime, command-line interface, language server, and MCP interface. The MCP layer is intended for structured agent access to this functionality rather than for replacing the complete RSigma command-line or streaming deployment options.

How it works

Rules are parsed from Sigma YAML into a strongly typed abstract syntax tree and compiled into optimized matchers. The engine can evaluate individual events using stateless rules or maintain state for correlation rules. Supported correlation behavior includes sliding, tumbling, and session windows, grouping, chaining, and suppression.

The timescale/rsigma MCP server communicates with clients over stdio or Streamable HTTP through the rsigma mcp serve command. Detection analysis can work with events in formats supported by RSigma, including JSON, syslog, logfmt, CEF, EVTX, plain text, and OpenTelemetry logs. Format detection is enabled by default. Processing pipelines compatible with pySigma can map fields and apply rule transformations before evaluation.

Setup and configuration

Run the MCP interface with RSigma’s mcp serve subcommand. The provided material identifies the command and transport modes but does not specify a package-manager installation command or a complete client configuration example, so installation details should be taken from the project documentation or release artifacts.

RSigma supports configuration through YAML files, environment variables, and command-line flags, managed through its config command group. The excerpt does not identify any environment variables that are required specifically to start the MCP interface. The project publishes prebuilt binaries for Linux, macOS, and Windows and also provides multi-architecture Docker images, but the exact invocation for those distributions is not specified here.

Tools and capabilities

The timescale/rsigma MCP server supports agent workflows involving:

• Drafting detection rules from exemplar events and a baseline corpus.
• Tuning rules with filters derived from false-positive events while checking that known true positives still match.
• Linting Sigma rules with 85 checks, multiple severity levels, suppressions, custom tag namespaces, and safe auto-fixes for 14 rules.
• Validating, converting, and documenting Sigma rules, including Palantir ADS metadata under rsigma.ads.*.
• Explaining rule decisions, comparing pipeline transformations, and inspecting live correlation windows.
• Evaluating events against compiled rules, including stateful correlation logic.

These capabilities are backed by the same Rust engine used by RSigma’s other interfaces. The underlying toolkit also supports schema recognition, logsource routing, and event prefilters, although the excerpt does not define each corresponding MCP tool separately.

Limitations and notes

The material does not list the individual MCP tool names, request schemas, response schemas, or client-specific configuration blocks. It also does not state whether a Streamable HTTP deployment includes authentication or authorization, so those details should be verified before exposing the HTTP transport beyond a trusted environment.

Array matching is described as experimental and requires sigma-version: 3. RSigma’s event ingestion and streaming features are broader than the MCP interface description; support for a particular input, sink, or deployment mode should not be assumed to mean that it is directly available as an MCP tool.