WRG Sigma Rules
Sigma detection-rule authoring, validation and multi-backend conversion, delivered as a Model Context Protocol (MCP) server with a published rule corpus. It runs under Claude Code, Codex, Cursor and any MCP-capable client.
draft_ruleturns a natural-language description into a Sigma YAML scaffold.validate_rulechecks a rule against pySigma plus a best-practice linter.convert_rulecompiles a rule to a Splunk, Elastic, OpenSearch or Kibana query.
The corpus holds 294 rules in 16 categories. It covers ransomware and threat-actor activity as well as vulnerabilities disclosed in AI/LLM applications and MCP servers.
Install
git clone https://github.com/WRG-11/wrg-sigma-rules.git
cd wrg-sigma-rules
pip install -r requirements.txt
claude plugin marketplace add .
claude plugin install wrg-sigma-rules@wrg-11That installs the server as a Claude Code plugin. Codex, Cursor and other MCP clients
take the same server; docs/install.md has the steps for each and the
notes on which interpreter runs it. Captured output from the tools is in
DEMO.md.
