timescale/RSigma Detection-as-Code

Lint, validate, fields-drift, backtest, and ATT&CK coverage gate for Sigma rules, powered by rsigma.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
version	rsigma release to install (e.g. v0.17.0). `latest` resolves the newest release once, then pins it for the cache key. Pinning a tag is recommended.	no	latest
rules	Rule file or directory, passed to every step.	no	rules/
pipelines	Pipeline names or paths (one per line), forwarded as repeated `-p` to validate, backtest, and the fields diff.	no	""
working-directory	Repo-relative root for all paths.	no	.
lint	Run the lint step.	no	true
validate	Run the validate step.	no	true
fields-diff	Run the merge-base fields-drift diff (pull requests only).	no	true
lint-fail-level	Forwarded to `rule lint --fail-level` (error/warning/info). The CLI default is `error`; this action defaults to the stricter `warning`.	no	warning
sources	Dynamic-source files or directories (one per line) for `rule validate --resolve-sources --source ...`.	no	""
corpus	Backtest corpus file or directory (one per line). The backtest step runs only when this is set.	no	""
expectations	Expectations YAML, forwarded to `rule backtest --expectations`.	no	""
unexpected	Forwarded to `rule backtest --unexpected` (fail/warn/ignore).	no	warn
coverage	Run the ATT&CK coverage step.	no	false
coverage-targets	Target technique list, forwarded to `rule coverage --targets`.	no	""
coverage-baseline	Baseline Navigator layer for `rule coverage --baseline`. Use `true` for the upstream SigmaHQ default, or a path/URL.	no	""
coverage-atomics	Atomic Red Team index for `rule coverage --atomics`. Use `true` for the upstream default, or a path/URL/directory.	no	""
fail-on-gaps	Forwarded to `rule coverage --fail-on-gaps`; fails the gate when a requested cross-reference reports uncovered techniques.	no	false
annotations	Emit workflow-command annotations on the PR diff.	no	true
pr-comment	Maintain the sticky summary comment on pull requests.	no	true
github-token	Token used to download the rsigma release, verify its attestation, and upsert the PR comment. Needs `pull-requests: write` for the comment.	no	${{ github.token }}

Outputs

name	description
rsigma-version	The resolved rsigma version that ran.
lint-errors	Lint error count from the JSON envelope summary.
lint-warnings	Lint warning count from the JSON envelope summary.
backtest-passed	`true` when the backtest ran and all expectations passed, `false` otherwise.
junit-path	Path to the backtest JUnit XML report, if produced.
report-path	Path to the backtest JSON report, if produced.
navigator-path	Path to the coverage ATT&CK Navigator layer, if produced.
fields-added	Number of rule fields added relative to the merge-base.
fields-removed	Number of rule fields removed relative to the merge-base.