Validation
Proven
| Claim | Evidence | Re-run |
|---|---|---|
| 99.7% of SigmaHQ parses under the documented subset (3,131 of 3,140 rules, 2026-07-08 clone) | corpus census; also runs in CI on every push | make corpus |
| The 9 remaining rules are reported as unsupported, with the construct named; nothing is silently approximated | per-construct list in the census output | make corpus |
| The matching engine implements the documented Sigma semantics (escaping, case rules, null, value lists, modifiers, condition grammar) | table-driven tests, including full rule-to-match round trips | make check |
check results hold up at corpus scale against real field lists |
SigmaHQ corpus check: 2,054 rules against Sysmon’s actual fields, 19 findings, each verified by hand | commands in the report |
| The matching engine agrees with an independent tool on real logs | cross-check against Chainsaw: every one of Chainsaw’s 712 matches reproduced over 3,241 events, none missed; the 242 extra detsema matches turned out to be Chainsaw misses (chainsaw#232) | contrib/sigma-diff |
| SARIF output is valid 2.1.0 | schema-shaped emitter, CI artifact | detsema check --format sarif |
Not proven
- Agreement with a second independent engine. Chainsaw is one tool on one log source, and the cross-check itself found a real Chainsaw bug, so agreement is evidence, not proof. Hayabusa is next.
- Production use.
checkhas run against synthetic schemas and public corpora, not yet against production rule repos with field lists derived from production events. - Keyword-search behavior varies between backends. detsema’s choice (substring match against every value in the event) is documented in SUBSET.md; no claim that every backend does the same.
- Inferred field lists only know the events they saw. A schema built from N sample events can miss fields and value ranges those events didn’t happen to contain.
Reporting a wrong result
If detsema says “unsupported” for something it should handle, that’s a coverage gap: open an ordinary issue. If detsema produces a wrong result — a match or a finding that disagrees with the Sigma specification or with a real backend — that is the highest-priority bug class this project recognizes. Use the false verdict template with a minimal rule, an event, what you expected and what you got.