In brief. detection-linter checks your Sigma and YARA rules for the mistakes that make them noisy, slow, or broken before they land in production: undefined selections, invalid levels, over-broad matches, unused strings, and catastrophic regular expressions. Static checks run with no setup; an optional AI layer explains what a rule catches and suggests evasions to test it against, so you can harden it.
The problem
A detection rule can be syntactically fine and still be a bad rule — one that matches far too much and buries the analyst in false positives, references a selection that doesn't exist, or hides a regular expression that will pin a CPU. Those problems are cheap to catch at review time and expensive to discover in production, which is exactly the kind of thing a linter is for.
How it works
Point it at Sigma (.yml) or YARA (.yar) files, a directory, or a glob, and it detects the type and runs the appropriate checks.
For Sigma, it verifies the required fields and a valid condition, catches conditions that reference a selection that was never defined (and selections defined but never used), flags invalid levels and thin log sources, and warns on detections broad enough to be noisy. For YARA, it checks balanced braces and a present condition, strings defined but never referenced, over-broad all of them conditions on a single string, very short ASCII strings that invite false positives, and nested-wildcard regular expressions that can be catastrophically slow. Findings are graded error, warning, or info, and it exits non-zero on any error so it fits a pre-merge check.
The optional AI layer
With a key, --ai adds a short explanation of the behavior each rule targets and two to four plausible evasions worth testing against. Understanding how a detection could be slipped past is how you decide whether it is tight enough — so the evasion suggestions are framed for hardening your own rule, not defeating someone else's.
Using it
# lint the built-in samples (a clean and a flawed rule of each type)
python -m detection_linter --demo
# your own rules
python -m detection_linter rules/
python -m detection_linter rules/my_rule.yml --aiLimits
This is a linter, not a compiler or a backtest. It reasons over rule text; it won't tell you whether a rule fires on real data, so run it alongside the real sigma and yarac toolchains. The Sigma checks cover the common structure but only partially understand exotic condition syntax, and the slow-regex check is a heuristic for obvious nested quantifiers rather than a full analysis. It catches the frequent, avoidable mistakes — which is most of them.