Detection-as-Code, now native in AI coding agents. RSigma v0.16.0 adds an MCP server: point Cursor, Claude Code, or any MCP client at it and your agent can parse, lint, validate, evaluate, convert, and fix Sigma rules as typed tools, getting structured JSON. github.com/timescale/rs...

RSigma v0.15.0 is out, focused on new conversion targets and Sigma extensions. 🚀 Highlights: • Fibratus backend • Array matching • Correlation window modes Release notes: github.com/timescale/rs...

My 3rd SEP (dynamic correlation windows) was rejected: windowing is a backend concern. RSigma ships it anyway: SEP: github.com/SigmaHQ/sigm... RSigma implementation: github.com/timescale/rs...

My 3rd proposal to the Sigma specification is up for review. Feedback is more than welcome! github.com/SigmaHQ/sigm...

One of the biggest releases of RSigma is out! 🚀 It includes layered YAML configuration, structured output and lots of overdue maintenance. Thanks to Fabian Wosar for contributing a nice feature to the linter. Repo: github.com/timescale/rs... Release notes: github.com/timescale/rs...

My second proposal to Sigma specification is up for review and feedback is much appreciated: github.com/SigmaHQ/sigm...

This is RSigma:

I am contributing the macOS port to Rustinel: github.com/Karib0u/rust...

I guess I'm an influencer now. Don't believe me? The receipts are public: github.com/SigmaHQ/pySi...

Based on the previous work and discussions on the Sigma Specification and the RSigma project, I created a Sigma Enhancement Proposal for Array Matching in Sigma. Please read and provide feedback. github.com/SigmaHQ/sigm...

RSigma v0.13.0 is out. Here's a sneak peek: 1. Post-evaluation enrichment. 2. Server-side TLS on the daemon API. 3. Field observability. 4. A unified EvaluationResult library API 5. Detached dynamic sources via a new --source flag. github.com/timescale/rs...

My sixth blog post about RSigma is out. In this one, I walk through how it detects suspicious events across 1.9M CloudTrail records. As always, feedback is welcome and much appreciated. mostafa.dev/cloud-detect...

RSigma v0.12.0 is out! 🎉 It contains improved daemon and CLI observability, fast Sigma rule loading, reorganized set of CLI subcommands, full-on documentation, improved test reliability and deps version bumps. Release notes: github.com/timescale/rs... Documentation: timescale.github.io/rsigma/

Detection Studio added support for real-time Sigma rule evaluation against sample data using RSigma: Website: detection.studio GitHub repo: github.com/northsh/dete... RSigma: github.com/timescale/rs...

Just shipped RSigma v0.11.0, the biggest eval engine update yet. 𝐇𝐢𝐠𝐡𝐥𝐢𝐠𝐡𝐭𝐬: • Matcher optimizer • Opt-in bloom filter prefilter • Opt-in cross-rule Aho-Corasick prefilter • Security hardening • Many more All optimizations are backward-compatible. github.com/srdnlen/rsig...

I just published my newest article, and the fifth in my RSigma series: “Wiring Live Threat Intel into Sigma Detection with Dynamic Pipelines” Dynamic pipelines let you turn public threat feeds into live detections without rewriting a single Sigma rule. mostafa.dev/wiring-live-...

RSigma v0.10.0, the "dynamic pipelines" release, is out. 🚀 What's new: • Dynamic Sigma Pipelines • Native EVTX input • 14 cargo-fuzz harnesses • Pipeline hot-reload and two builtin pipelines Release notes: github.com/timescale/rs... Contributions and feedback are welcome.

In my new article, I cover an E2E security observability solution using RSigma, LGTM stack and more. The core technique is creating a single Grafana Alerting rule with dynamic labels, allowing metric labels to be extracted and reported as separate alert instances. mostafa.dev/security-obs...

RSigma v0.9.0 is released! 🚀 • Production-grade NATS JetStream • Native OpenTelemetry log ingestion • LynxDB conversion backend • Field catalog • Structured exit codes for CI/CD scripting • Per-rule Prometheus metric labels • Comprehensive E2E test suite github.com/timescale/rs...

What if Sigma detection rules were just SQL? RSigma now converts 3,800+ SigmaHQ rules to native PostgreSQL queries. JSONB, views, TimescaleDB continuous aggregates, temporal correlation; all from YAML. No SIEM. Just psql, pg_cron, and Grafana. mostafa.dev/building-a-d...

RSigma v0.8.0 is out! New conversion engine turns Sigma detection rules into backend-native queries. First backend: PostgreSQL/TimescaleDB, with no equivalent in pySigma. Multi-arch Docker images, one-to-many field mapping, and full filter parity. github.com/timescale/rs...

I wrote a new blog post, where I streamed events to RSigma with four SigmaHQ Okta rules, and watched it correlate individual detections into a single critical alert. Each detection alone? Noise. All four from the same actor in 30 minutes? Incident. mostafa.dev/streaming-lo...

RSigma v0.7.0, the "any log format", is out! The Sigma detection engine now ingests JSON, syslog, logfmt, CEF, and plain text with auto-detection. 1M+ events/sec on JSON, 10M+/sec on plain text. Inspired by Sigma Engine by Sigma HQ. github.com/timescale/rs...

My project, RSigma, and the associated blog post are published in Zack Allen's latest newsletter, Detection Engineering Weekly. 🎉 www.detectionengineering.net/p/dew-149-ro...

I just published a new article about a project I've been working on past couple of weeks: mostafa.dev/declarative-...

What if jq could hunt threats, too? mostafa.dev/fab16334e4ee

Over the past couple of weeks I've been busy cooking something in Rust. A generic HTTP API log collector for audit trails: github.com/timescale/helr And a parser, linter, evaluator and backend for Sigma in Rust along with an experimental LSP: github.com/timescale/rs...

xk6-kafka v1.2.0 is out! 🚀 This release brings an updated k6 baseline, a new Avro implementation, better precision and resiliency around time handling, balancer functions in JS, plus a handful of quality-of-life and security linting fixes. github.com/mostafa/xk6-...

I just published a new article on GCP canary tokens by turning Google Cloud service accounts into high-signal tripwires. mostafa.dev/gcp-canary-t...

I just published a new blog post: "Detection as Code". I break down what detection & response really means in practice, how Sigma fits into the picture, and a brief intro to the Sigma Rule Deployment (SRD) project we built during my time at Grafana. mostafa.dev/detection-as...

I'm happy to share that I'm starting a new position as Lead Security Engineer at Tiger Data (creators of TimescaleDB)!

I've been accepted into the Google Developer Experts Academy! I'm working toward becoming a GDE in Cloud, with a strong focus on security.

After nearly five months of development and testing, I'm truly content to share that the auto-fix feature is now stable in v1.15.0. 🎉 Epic ticket: github.com/zizmorcore/z... Release announcement: github.com/zizmorcore/z... Blog post: mostafa.dev/github-actio... Crate: crates.io/crates/yamlp...

I will be speaking at Devfest Berlin on November 22, 2025, presenting a session called "Tiny Little Birds", where I talk about canary tokens. The talk is based on my recent blog post on Grafana Labs blog: grafana.com/blog/2025/08... I look forward to seeing many of you in Berlin.

The Sigma Rule Validator project, that I created and we donated to the Sigma project, is now being used in two security training courses: 1. CJDE from Security Blue Team 2. Detection Engineering with Sigma by Applied Network Defense blog.sigmahq.io/how-to-valid...

Happy to see my article on canary tokens featured again, this time in the "CTO at NCSC" newsletter! ctoatncsc.substack.com/i/172751253/... Big thanks to Ollie Whitehouse for the mention. Here's original write-up on the Grafana Labs blog: grafana.com/blog/2025/08...

Excited to see my write-up on canary tokens at Grafana Labs featured in this week's Detection Engineering Weekly! grafana.com/blog/2025/08... Big thanks to the Detection Engineering Weekly team for the shout-out! 🙌 👉 Read the full issue here: www.detectionengineering.net/p/dew-131-ne...

The SAML SSO package I've been maintaining surpassed 1 million downloads. 🎉 As promised, the second part is now live. In this article, I'll show you how to configure a fresh Django app to authenticate with Okta using the SAML 2 protocol: mostafa.dev/saml-sso-in-...

Thanks @thinkstcanary.canary.tools for making this awesome platform! 🙌 If you still haven't read my blog post, here it is: grafana.com/blog/2025/08...

I haven't been mentioned once, but twice, in the [tl;dr sec] newsletter #297 about my two recent articles on canary tokens and zizmor. 🎉🙌 tldrsec.com/p/tldr-sec-297

After 6+ years, my journey at Grafana Labs is coming to a close. I feel grateful for the opportunities I had to grow, build and contribute. Grafana Labs will always hold a special place in my heart. ♥️ Now it's time to turn the page and start a new chapter. 🚀

An incident inspired me to contribute to an OSS security project. Here's a quick read on my journey: mostafa.dev/github-actio...

🚀 The project I've been maintaining for 6 years just hit 1 million downloads! 🎉 I'm also continuing my series on SAML SSO and the next article is coming soon. In case you missed the first one: mostafa.dev/saml-sso-in-... Repo: github.com/grafana/djan...

How do you know you're compromised? Read my newest article to see how we used canary tokens to detect an attack on our infrastructure. grafana.com/blog/2025/08...

The SAML SSO package I've been maintaining is about to hit 1 million downloads. 🎉 I saw this milestone as a great opportunity to share what I've learned and write a series of articles on SAML SSO. The first part is now live: mostafa.dev/saml-sso-in-...

I wrote a tiny article about detection of PII with Python: Feedback is welcome! 🙏 mostafa.dev/detecting-pi...

Published my first package to crates.io as part of the zizmor project. 🎉 Yamlpatch crate provides comment and format-preserving YAML patch operations using yamlpath, without the hassle of going through conversion to JSON and using JSONPath. crates.io/crates/yamlp...

Do you want to find out more about how @grafana.bsky.social secures its GitHub actions using Zizmor? Check out this post from James on my team : grafana.com/blog/2025/06... @yossarian.net

zizmor v1.10.0 is released! this is a *huge* new release: it exposes a new (experimental) auto-fix mode, more precise subspanning for fixtures, as well as a brand new pedantic audit (anonymous-definition) read the full notes here: docs.zizmor.sh/release-note...