sigma-cli: a check issue is a linter row, not a hit

The table is about the YAML

sigma check reads rule files and reports problems in them: a missing identifier, a duplicate title, a condition that does not parse. Each issue names a file and a kind of problem. Nothing in that table is a log event, a host, or a time when a detection matched.

The severity column on the check summary is the validator’s ranking of the issue. It is not the level field inside the rule, and it is not a SIEM severity. Write “linter label” beside it if you quote it.

An issue name is a category of mistake

A missing-identifier issue means the YAML has no stable id. A duplicate-title issue means two files share a title. Those are facts about the repository. They do not mean two alerts fired, and they do not mean an alert in production is missing an id.

Fixing the YAML is a pull request. It is not an incident ticket. If a production search is also broken, that is a separate note with the query and the index, not this table.

What to file

File the command’s time, the issue name, the file path, and the linter severity labeled as the linter’s. File the rule id if the file has one. Do not add a host, a user, or a match count. The check did not produce those.

Worked case: a missing id filed as an alert

sigma check on the lab rules prints one issue: the file rules/lab-agent.yml has no identifier. The table’s severity cell says medium. A draft opens a detection ticket: “medium alert, lab-agent, no id in the SIEM.”

The note says the issue is a linter row, the file lacks an id, and medium is the validator’s label. There is no log event. The work is to add an id in the YAML. The SIEM is not mentioned, because this command did not query it.

command: sigma check on the lab rules
issue: identifier missing
file: rules/lab-agent.yml
severity cell: medium (linter label)
log events: none
write: YAML has no id, not a SIEM hit