rsigma engine eval🔗

One-shot evaluation of Sigma rules against events from a file, stdin, or an inline argument.

Synopsis🔗

rsigma engine eval [OPTIONS] --rules <RULES>

Description🔗

Loads rules from a file or directory, optionally applies one or more processing pipelines, reads events from --event (or stdin), and writes matched MatchResult JSON to stdout. Exits when the event source is exhausted.

This is the right tool for CI fixtures, ad-hoc threat hunting, forensic replay over .evtx and NDJSON files, and any "run rules against this data, then exit" workflow. For a long-running daemon with hot-reload and metrics, use engine daemon.

For a narrative tutorial see Evaluating Rules.

Flags🔗

Required🔗

Configuration🔗

Input selection🔗

Pipeline🔗

Output🔗

The global --output-format / --color / --quiet / --no-stats flags apply here too; see Output Formats. The flags below are eval-specific.

Correlation behavior🔗

Performance (advanced)🔗

Field observability (offline coverage report)🔗

The same gap / broken-coverage signals exposed by the daemon's /api/v1/fields* endpoints are available offline as a one-shot report:

# CI: keep stdout for detection NDJSON, stderr for logs, report in its own file
rsigma engine eval -r rules/ -e @events.ndjson \
    --observe-fields \
    --observe-fields-report coverage.json

# Quick interactive run: the report shows up on stderr alongside the
# "Processed N events, M matches." line
rsigma engine eval -r rules/ -e @events.ndjson --observe-fields

See Observability: detection coverage for the operator workflow shared with the daemon path.

CI gating🔗

Examples🔗

Single inline event🔗

rsigma engine eval -r rules/ -e '{"CommandLine":"cmd /c whoami"}'

NDJSON file with pretty output🔗

rsigma engine eval -r rules/ --pretty -e @events.ndjson

Table view for interactive triage🔗

rsigma engine eval -r rules/ -e @events.ndjson --output-format table

A width-aligned LEVEL | RULE | TYPE | DETAIL table appears on stdout. Use --output-format csv or --output-format tsv to pipe into a spreadsheet instead. See Output Formats.

EVTX file with the bundled Windows-mapping pipeline🔗

rsigma engine eval -r rules/ -e @Security.evtx

EVTX records are nested under Event.System.* and Event.EventData.*; rules must reference fields by their full dotted path. See Input Formats.

Tail a JSON log file into the engine🔗

tail -F /var/log/app.json | rsigma engine eval -r rules/

Extract events from a wrapper envelope🔗

rsigma engine eval -r rules/ --jq '.records[]' < otlp-batch.ndjson

CI fixture: assert nothing matches🔗

rsigma engine eval -r rules/ --fail-on-detection -e @ci/negative.ndjson

Exits 1 if any rule fires. Exits 0 if the fixture stays quiet.

Apply a builtin pipeline🔗

rsigma engine eval -r rules/ -p ecs_windows -e '{"process.command_line": "whoami"}'

Correlation with suppression🔗

rsigma engine eval -r rules/ --suppress 5m --action reset \
    --correlation-event-mode refs --max-correlation-events 50 \
    < security-events.ndjson

Exit codes🔗

See also🔗

• Evaluating Rules for the narrative version with event-extraction patterns and correlation walkthroughs.
• Input Formats for JSON, syslog, logfmt, CEF, EVTX, OTLP, plain text, and auto-detect.
• Processing Pipelines for -p semantics and the builtin pipelines.
• Performance Tuning for --bloom-prefilter and --cross-rule-ac.
• CI/CD for --fail-on-detection patterns.
• engine daemon for the long-running streaming counterpart.