Stories by Mostafa Moradian on Medium
One detection’s journey around the detection engineering lifecycle, and how far a single binary carries it The first State of RSigma ended with a sentence that was doing more work than it let on: “the direction of the work is to close the loop around it.” Detections tested like code, coverage measured rather than guessed, weak signals aggregated into strong ones, authoring that meets engineers…
Lint, validate, fields-drift, backtest, and ATT&CK coverage for Sigma rules in one workflow This is the seventh article in a series on RSigma . The first article introduced RSigma as a CLI tool for evaluating Sigma rules against JSON logs. The second covered running it as a streaming daemon with HTTP and NATS input, stateful correlation, and persistent state. The third showed how to convert Sigma…
A tour of what one Rust binary does for detection engineering today, and where it is headed Since RSigma showed up earlier this year, the detection engineering community has been trying to decide what to call it. In Detection Engineering Weekly #149 , Zack Allen reached for the flattering version: “RSigma is essentially a SIEM.” Soon after, I drew a more careful line in the streaming article :…
How RSigma streams 1.9 million CloudTrail events through a community IR playbook This is the sixth article in a series on RSigma . The first article introduced RSigma as a CLI tool for evaluating Sigma rules against JSON logs. The second covered running it as a streaming daemon with HTTP and NATS input, stateful correlation, and persistent state. The third showed how to convert Sigma rules into…
Turning public threat feeds into live detection without rewriting a single rule This is the fifth article in a series on RSigma . The first article introduced RSigma as a CLI tool for evaluating Sigma rules against JSON logs. The second covered running it as a streaming daemon with HTTP and NATS input, stateful correlation, and persistent state. The third showed how to convert Sigma rules into…
Converting Sigma Rules to Dynamic Grafana Alerts This is the fourth article in a series on RSigma . The first article introduced RSigma as a CLI tool for evaluating Sigma rules against JSON logs. The second covered running it as a streaming daemon with HTTP and NATS input, stateful correlation, and persistent state. The third showed how to convert Sigma rules into PostgreSQL SQL and run them as…
How RSigma turns 3,800+ community detection rules into SQL queries for TimescaleDB This is the third article in a series on RSigma . The first article introduced RSigma as a CLI tool for evaluating Sigma rules against JSON logs. The second article covered running it as a streaming daemon for real-time detection. This one is about something different: what if you already have the data in…
Turning Four Routine Okta Detections into One Critical Alert Update (April 2026): The original version of this article included a processing pipeline to map lowercase Sigma rule field names to Okta’s camelCase API fields. After Nasreddine Bencherchali , from the Sigma project, read this article, he realized the SigmaHQ Okta rules were using incorrect lowercase field names at the source, and every…
Introducing Helr: a Rust-based generic HTTP API log collector that turns YAML config into a resilient log pipeline You have a growing list of SaaS services: Okta for identity, Google Workspace for email and docs, GitHub for code, Slack for communication, 1Password for secrets, Tailscale for networking and possibly many others. Each one exposes an audit log API. You need those logs for compliance,…
Introducing RSigma: a Rust toolkit for evaluating Sigma detection rules against JSON events without a SIEM high-level detection pipeline You have a stream of JSON logs. Maybe it’s an NDJSON export from an incident investigation, a dump of Okta audit events, CloudTrail records from a compromised AWS account, or simply the output of a service you’re debugging. You want to find suspicious patterns,…