[Copilot]

New module that evaluates parsed log events against Sigma rules (and correlation rules) at runtime, producing SigmaMatch objects. No new dependencies — uses only stdlib.

Architecture

• Logsource dispatch table routes events to relevant matchers in O(1)
• MatchCompiler walks the parsed condition tree and emits a Python callable via compile()/exec() with restricted builtins — all regex patterns and comparison values are bound at init time
• SigmaCorrelationRuleMatcher implements sliding-window correlation for all 8 types (event_count, value_count, temporal, temporal_ordered, value_sum/avg/median/percentile)
• MessageChannel abstraction (queue-based InProcessChannel) designed for future ZMQ/network adapter drop-in

Module structure (sigma/matching/)

• event.py — Event, EventLogSource dataclasses
• match.py — SigmaMatch result
• channel.py — transport abstraction
• compiler.py — detection tree → compiled Python callable
• rule_matcher.py — per-rule evaluator using precompiled matcher
• state.py — SlidingWindowState (time-sorted deques, size + time eviction)
• correlation_matcher.py — correlation logic with group-by and field alias resolution
• matcher.py — SigmaMatcher orchestrator (context manager, pipeline application, dispatch)

Usage

from sigma.collection import SigmaCollection
from sigma.matching import Event, EventLogSource, SigmaMatcher

collection = SigmaCollection.from_yaml(rule_yaml)
with SigmaMatcher(collection) as matcher:
    matches = matcher.match(Event(
        timestamp=now,
        logsource=EventLogSource(category="process_creation", product="windows"),
        data={"CommandLine": "mimikatz.exe"},
    ))