sigma-cli: level is a label in the YAML

Level describes the rule, not a run

A Sigma rule can set level to a word such as low, medium, or high. That word is on the rule whether the rule has matched anything. A lab search that returns no rows does not lower the level. A search that returns many rows does not raise it.

The word is the author’s ranking of the rule they wrote. It is not a measurement of this week’s logs.

Do not mix it with other severities

sigma check prints its own severity on validator issues. That column is about the YAML problem, not this level field. A detection in a SIEM may show yet another priority after someone mapped it. If you cite a priority from the SIEM, say it came from the SIEM. If you cite level, say it came from the YAML.

A header on a saved query does not replace the level unless the header actually includes it. Do not assume the backend copied the word.

What to file

File the rule id and the level as printed in the YAML. File hit counts separately, with the query they came from. Do not write “high priority incident” from the level word when you have not said it is the YAML label and you have not cited a log event.

Worked case: high, and zero lab rows

Rule 4c1e0a2b-7d44-4b1a-9c0e-lab000000001 has level high. A search of the lab index for its converted query returns 0 rows. A draft opens a high-priority incident because the YAML says high.

The note quotes level high as the YAML label and 0 rows as the lab search. There is no log event to attach. The incident is not opened. The level stays on the rule for when a later search returns a row, and that later row is what would be filed, still with the label named as a label.

rule: 4c1e0a2b-7d44-4b1a-9c0e-lab000000001
level: high (YAML label)
lab search: 0 rows
log event: none
write: label plus a zero count
not: a high-priority incident