rsigma rule condition🔗

Parse a Sigma condition expression and print the AST.

Synopsis🔗

rsigma rule condition [OPTIONS] <EXPR>

Description🔗

Takes a Sigma condition string (the right-hand side of condition: in a rule) and prints its parsed AST as JSON. Useful for tooling that reasons about condition trees, for sanity-checking a complicated expression before pasting it into a rule, and for understanding precedence on expressions with mixed and, or, not, and 1 of/all of quantifiers.

Flags🔗

Examples🔗

Simple selection🔗

rsigma rule condition 'selection'

Combined selections🔗

rsigma rule condition 'selection and not filter'

Quantified expressions🔗

rsigma rule condition '1 of selection_* and not filter_*'

Aggregate (correlation) syntax🔗

rsigma rule condition 'selection | count() by User > 5'

Exit codes🔗

See also🔗

• Sigma specification: condition expressions for the official condition grammar.
• rule parse for parsing a full rule (including its condition).
• Concepts for the Sigma primer.