Output Format

The tool produces regression data compatible with the SigmaHQ repository format, ready for PR submission. This page documents what the pipeline writes; the full schema (info.yml, naming conventions, validation) is specified in regression-data-format.md.

Directory structure

The output always lives inside the sigma repo, under regression_data/:

<sigma_repo_path>/regression_data/
└── <rule_rel_path>/         # mirrors the rule path under sigma/rules/
    ├── info.yml
    ├── <rule_id>.json       # optional (regression.add_json_output)
    └── <rule_id>.evtx       # or <rule_id>.log on Linux

The directory mirrors the rule path under rules/. For example:

sigma/rules/windows/builtin/security/win_security_foo.yml
    → sigma/regression_data/rules/windows/builtin/security/win_security_foo/

What the pipeline writes

File	Content	Condition
info.yml	Test metadata (always written)	—
<rule_id>.evtx	Valid binary EVTX (Windows)	default
<rule_id>.log	Original lines (Linux)	default
<rule_id>.json	Serialized raw event	regression.add_json_output: true

EVTX (Windows)

<rule_id>.evtx is produced by EvtExportLog (re-queries the event by RecordID from the live log, short-backoff retries) or, for record-id-less events, by the pure Rust EVTX writer (evtx_writer module of sigmacatch::regression, deterministic, no retry). The exported file is validated (re-parse ≥ 1 record); an empty/corrupt export (event rotated out between collection and export) is an error: the pipeline skips the rule for that cycle (no commit) and re-captures it later.

Auxiliary JSON

The .json carries the actual data used for Sigma matching (event_json_raw). Its shape depends on the producer: nested and a verbatim mirror of the Winevt XML for Windows events, flat ({message, program, host?}, host optional) for syslog and structured ({stamp, type, node?, fields}) for auditd on Linux. The pipeline writes a single JSON object terminated by exactly one trailing newline; the validator (regressiondata-check) also accepts JSONL (one object per line). See regression-data-format.md for examples.

Source rule annotation

The source Sigma rule YAML is also annotated with:

regression_tests_path: regression_data/rules/<rule_rel_path>/info.yml