sigma-cli: status is a lifecycle word

Status describes the rule’s place

A Sigma file can set status to a word such as test, experimental, stable, or deprecated. That word is the author’s placement of the rule. It sits on the file whether or not anyone has searched with it.

It is not the level field. Level is a different label. Do not read test as low, or stable as high.

A search still returns rows

If you run a converted query and it returns rows, those rows are results of that search. The status word does not delete them. Dropping a row because the YAML says test is dropping a result, and the note should not pretend the search was empty.

Stable does not confirm that a row is an incident. The word never becomes a verdict.

What to file

File the rule id, the status word labeled as the lifecycle field, and any hit count from the search you ran. If status is absent, write “status not in the file.” Do not borrow the level word to fill it.

Worked case: three rows dropped because the rule said test

Rule file lab-heartbeat.yml has status test. A search of the lab index returns 3 rows. A draft deletes the rows from the ticket because a test rule’s output does not count.

The note quotes status test as the lifecycle word and 3 as the lab search count. The rows stay in the ticket as search results. Test does not mean the count is zero.

file: lab-heartbeat.yml
status: test
lab search: 3 rows
write: lifecycle word and the count
not: the rows do not count