Sigmacatch

⚠️ WIP — this project is under active development. APIs, config, and output formats may change without notice. Not production-ready.

Capture real Windows events via the Windows Event Log API (winevt), match them against SigmaHQ rules, and output structured regression data ready for SigmaHQ PRs.

What it does

SigmaHQ rules (auto-cloned via grit-lib)
    ↓
Load rules → skip existing regression → filter Windows → apply pipeline
    ↓
Resolve channels from rules (logsource → channel mapping)
    ↓
Continuous collector (live Windows events via EvtQueryW) → mpsc
    ↓
Sigma engine evaluates every event against all loaded rules
    ↓
Every 30s: generate regression triplet for each matched rule
    ↓
sigma/regression_data/<rule_rel_path>/
    ├── <rule_id>.json    ← flat event (Sigma keys)
    ├── <rule_id>.evtx    ← valid EVTX (via EvtExportLog) or .xml fallback
    └── info.yml          ← SigmaHQ-compatible metadata
    ↓
commit + push to fork (continuous until Ctrl+C)

Quick start

cargo build --release
./target/release/sigmacatch

On first run, a config.yaml is created with defaults:

git:
  author: "your-username"
  email: "you@example.com"
  github_token: ""          # GitHub token (or set GITHUB_TOKEN env var) — required for fork push
  transport: http           # http or ssh
  sigma_repo_url: "https://github.com/SigmaHQ/sigma.git"
  sigma_repo_path: "sigma"
log:
  level_file: "debug"
filter:
  product: windows          # windows, linux, or macos
  min_status: "stable"      # load rules with status >= this threshold
  min_level: "critical"     # load rules with level >= this threshold
  author: ""                # filter rules by author (optional, empty = no filter)
  max_rule_size: 1048576    # bytes (1MB default)

Rules below the configured min_status / min_level thresholds are skipped at load time. Rules missing a status or level field are always accepted.

CLI flags

Flag	Description
--author <name>	Override detected username
--dry-run	Git diagnostics only (no collection)
--channels-only	List resolved channels and exit (no collection)
--all-rules	Load all rules — skip set is disabled
--list-rules	List rules without regression data and exit (no collection)

Requirements

• Windows with Sysmon installed — required for rich events (ParentImage, CommandLine, hashes, etc.)
• Rust 2021 edition (1.70+)
• Admin rights for Security and System Event Log channels

Cross-compilation (Linux → Windows)

cargo xwin build --release --target x86_64-pc-windows-msvc

Nécessite cargo install cargo-xwin. Télécharge automatiquement le Windows SDK.

On Linux/macOS the collector is a stub (returns empty vec) — the pipeline still runs end-to-end for testing.

Documentation

A built version of this documentation is published to GitHub Pages: https://frack113.github.io/sigmacatch/

	English	Francais
Architecture	EN	FR
Architecture reference	EN	FR
Build	EN	FR
Output format	EN	FR
Regression data format	EN	FR
Nice-to-have	EN	FR
Tools	EN	FR

Workspace

The project is a cargo workspace of 11 crates (9 libraries + 2 binary crates):

Crate	Purpose
sigmacatch	Binary + orchestration (continuous loop)
sigmacatch-config	Config YAML + CLI parsing + custom_channels.yaml + dry-run git diagnostics
sigmacatch-logger	Two-layer tracing subscriber (stderr info + daily rolling file debug)
sigmacatch-rule	SigmahqRules: rule loading, filtering, deduplication, channel resolution
sigmacatch-detection	Thin wrapper around rsigma-eval (pipelines, bloom, LogSourceExtractor)
input-windows-channels	Multi-channel Winevt collector (EvtQueryW/EvtNext/EvtRender)
sigmacatch-regression	SigmahqRegression, InfoYml, regression triplet generation
sigmacatch-types	Shared types: Event, Alert, RegressionHeader, XML parsing, logsource tables
sigmacatch-repo	grit-lib wrapper: SigmaRepo, GitHub fork detection, commit workflow
input-evtx	Parse EVTX files into Event objects for the detection engine
localcheck	Dev tools: check_filter (filter validation) + check_evtx (regression validation)

Built with

• rsigma-eval + rsigma-parser — Sigma rule loading and evaluation
• grit-lib — pure Rust git, no CLI needed
• tokio — async runtime
• windows — Windows Event Log API, cfg-gated
• serde / serde_json / yaml_serde — serialization
• roxmltree — XML parsing for Winevt events
• evtx — EVTX file parsing

License

MIT