In-repo rsigma agent skill

[mostafa]

Summary

Add an Agent Skill under skills/rsigma/ that teaches current rsigma CLI groups and the MCP write-lint-evaluate-convert loop. Keep timescale/sigma-rules as the vendor-neutral Sigma authoring skill. After the skill is on main, archive timescale/sigma-backends with a redirect README.

Motivation

timescale/sigma-backends documents a CLI that no longer exists (rsigma eval, rsigma lint, rsigma validate, rsigma daemon as top-level commands; 65 lint rules and 13 auto-fixes). The shipped tree is noun-led (engine, rule, backend, pipeline, mcp, config) with 85 lint checks and 14 auto-fixes, plus draft, tune, backtest, convert, MCP, and schema classify. There are no aliases for the old forms, so agents following that skill emit failing commands.

A standalone skill repo cannot stay current. The product already converts natively (postgres, lynxdb, fibratus) and delegates other targets through rsigma backend convert to an installed sigma-cli, so a separate backends skill duplicates that path and fights the rsigma skill on trigger words.

timescale/sigma-rules stays. It teaches Sigma YAML (spec, modifiers, correlation, filters, pipelines) for any backend, not only rsigma.

Proposed approach

skills/rsigma/ is the publish source. The skills CLI walks skills/ when adding a repo, so npx skills add timescale/rsigma finds it. Opening an rsigma checkout does not load the skill.

skills/rsigma/
  SKILL.md
  references/
    workflows.md

SKILL.md stays under ~200 lines. Frontmatter description names rsigma workflows (engine eval, engine daemon, rule lint, rule draft, rule tune, rule backtest, backend convert, mcp serve) and sends Sigma YAML authoring to sigma-rules. Body: command-group map, prefer MCP when rsigma mcp serve is connected, a short native-versus-delegated convert section, pointer to sigma-rules, and "read workflows.md when…". workflows.md holds the MCP loop. Do not add mcp.md or backends.md. Do not paste flag tables; those live under docs/content/cli/ and rsigma.io. Do not hardcode lint-check or auto-fix counts; point at the lint guide.

Teach:

• Current command names that replaced rsigma eval / rsigma lint
• The MCP loop in the MCP server guide: draft/parse → lint/fix → evaluate/exemplars → tune → validate → convert
• When to pick engine eval vs engine daemon, rule draft vs hand-authored YAML, native convert vs sigma-cli delegation

Install:

npx skills add timescale/sigma-rules -g -y
npx skills add timescale/rsigma -g -y

Treat skills/rsigma/ as release-adjacent, same as docs/. If a PR renames a CLI command, adds or removes an MCP tool, or changes a workflow the skill teaches (draft, tune, eval, convert, daemon), update skills/rsigma/ in that same PR.

After the skill is on main, update the sigma-backends README to point at timescale/sigma-rules and npx skills add timescale/rsigma -g -y, then archive the repo (leave git history; do not delete it). Optional one-line cross-link on sigma-rules and an install snippet on the rsigma README / getting-started page.

Out of scope

• Folding sigma-rules into this repo or archiving it
• Duplicating the Sigma specification, templates, or modifier tables
• A full CLI encyclopedia inside the skill
• Hardcoded lint-check or auto-fix counts
• A second copy under .cursor/skills/
• Commands that are not already shipped

Tasks

• Author skills/rsigma/SKILL.md and references/workflows.md from current CLI and MCP docs (not by copying sigma-backends)
• Point the skill at sigma-rules for authoring; do not duplicate templates
• Optional: install snippet on the rsigma README / getting-started page
• After the skill is on main: update the sigma-backends README, then archive the repo
• Optional: one-line cross-link on sigma-rules

References

• docs/content/cli/index.md
• docs/content/cli/backend/convert.md
• docs/content/guide/mcp-server.md
• timescale/sigma-rules
• timescale/sigma-backends

[mostafa]

Shipped in #501. skills/rsigma/ is on main, with install notes on the README and the getting-started page. timescale/sigma-backends is archived with a redirect README. The optional one-line cross-link on timescale/sigma-rules was not added.