Detection Rules Python Packages

wazuhcoverage

A small batch CLI for measuring coverage in Wazuh JSON archives.

pysigma-backend-sumologic

pySigma backend for Sumo Logic Cloud SIEM rule conversion

rule-doctor-lite

Free read-only check: which custom Wazuh rules never fire, and why (including rules Wazuh drops at load). Python 3, one file.

txt2detection

A command line tool that takes a txt file containing threat intelligence and turns it into a detection rule.

pysigma-backend-victorialogs

pySigma backend that converts Sigma detection rules to LogsQL queries for VictoriaLogs

tracesig

Sigma-style detection rules for AI agent tool-call traces: 23 provenance, taint and sequence rules. Scans Claude Code sessions and agent-policy-gateway audit logs; works on any agent's JSONL trace.

aitdp

AI Threat Detection Protocol — open spec, community ruleset and reference SDK for detecting prompt injection, jailbreaks, data exfiltration and tool abuse in LLM apps and AI agents.