Sigmacatch

Capture real Windows events via the Windows Event Log API (winevt), match them against SigmaHQ rules, and output structured regression data ready for SigmaHQ PRs.

What it does

SigmaHQ rules (auto-cloned)
    ↓
WinevtCollector (live Windows events)
    ↓
Sigma engine evaluation (every event against all rules)
    ↓
regression_data/<rule>/
    ├── <rule_id>.json    ← flat event (Sigma keys)
    ├── <rule_id>.evtx    ← valid EVTX (via EvtExportLog) or .xml fallback
    └── info.yml          ← SigmaHQ-compatible metadata

Quick start

cargo build --release
./target/release/sigmacatch

On first run, a config.yaml is created with defaults:

author: "your-username"
email: "you@example.com"
github_token: ""          # GitHub token (or set GITHUB_TOKEN env var) — required for fork push
log:
  level_file: "debug"
sigma:
  min_status: "stable"    # load rules with status >= this threshold
  min_level: "critical"   # load rules with level >= this threshold

Rules below the configured min_status / min_level thresholds are skipped at load time. Rules missing a status or level field are always accepted.

CLI flags

Flag	Description
--author <name>	Override detected username

Requirements

• Windows with Sysmon installed — required for rich events (ParentImage, CommandLine, hashes, etc.)
• Rust 2021 edition (1.70+)
• Admin rights for Security and System Event Log channels

Cross-compilation (Linux → Windows)

cargo xwin build --release --target x86_64-pc-windows-msvc

Nécessite cargo install cargo-xwin. Télécharge automatiquement le Windows SDK.

On Linux/macOS the collector is a stub (returns empty vec) — the pipeline still runs end-to-end for testing.

Documentation

A built version of this documentation is published to GitHub Pages: https://frack113.github.io/sigmacatch/

	English	Francais
Architecture	EN	FR
Architecture reference	EN	FR
Build	EN	FR
Output format	EN	FR
Regression data format	EN	FR
Nice-to-have	EN	FR

Built with

• rsigma-eval + rsigma-parser — Sigma rule loading and evaluation (rule engine, parse_sigma_yaml, add_collection)
• grit-lib — pure Rust git library for clone, fetch, push, branch, commit, checkout. No git CLI needed.
• tokio — async runtime for git ops and orchestration
• windows — Windows Event Log API (EvtQueryW/EvtNext/EvtRender/EvtExportLog), cfg-gated
• rayon — parallel rule parsing
• serde / serde_json / serde_yaml — config and event/regression serialization
• tracing + tracing-subscriber — logging

License

MIT