Join us at the premier vendor-neutral open source conference, where developers and technologists come together to collaborate, share knowledge, and explore the latest innovations and advancements in open source technology. Learn more at https://events.linuxfoundation.org/
Detection Engineering with RSigma - Mostafa Moradian, Tiger Data
Sigma is the open, vendor-neutral standard for detection rules, yet most Sigma tooling only translates rules into another vendor's query language. RSigma is a toolkit that evaluates Sigma directly against logs in real time: a parser, a compiled matcher, a stateful correlation engine, and a streaming daemon in one small static binary.
This is a working session on detection engineering for Linux. We take kernel-sourced telemetry (the audit subsystem, journald and syslog, and eBPF sensors), stream portable Sigma detections over it on the host, and correlate weak signals into high-fidelity alerts with a small footprint and no SIEM in the loop. Then we treat detections as code: lint, test against known-good/known-bad fixtures, measure ATT&CK coverage, and gate everything in CI.
Expect Rust internals, real auditd and eBPF events, live rules, and an honest account of what a self-contained engine should and should not own. Everything shown is open source and reproducible.
Detection Engineering with RSigma - Mostafa Moradian, Tiger Data
Sigma is the open, vendor-neutral standard for detection rules, yet most Sigma tooling only translates rules into another vendor's query language. RSigma is a toolkit that evaluates Sigma directly against logs in real time: a parser, a compiled matcher, a stateful correlation engine, and a streaming daemon in one small static binary.
This is a working session on detection engineering for Linux. We take kernel-sourced telemetry (the audit subsystem, journald and syslog, and eBPF sensors), stream portable Sigma detections over it on the host, and correlate weak signals into high-fidelity alerts with a small footprint and no SIEM in the loop. Then we treat detections as code: lint, test against known-good/known-bad fixtures, measure ATT&CK coverage, and gate everything in CI.
Expect Rust internals, real auditd and eBPF events, live rules, and an honest account of what a self-contained engine should and should not own. Everything shown is open source and reproducible.