sigma-rule-helper
A small helper for reviewing Sigma rules with narrow, explainable checks.
Keeps rule review local and the checks easy to inspect.
Focus
This project applies small review checks to Sigma rules. The useful output is something a reviewer can investigate, rather than an opaque score or a claim that the rule is correct.
Evidence
The repository contains the current checks, sample rules and tests. It is intentionally a helper for a human review workflow.
Boundaries
It does not validate a rule against a production telemetry pipeline or replace testing detections with representative events.