[package]
name = "rsigma"
description = "CLI for parsing, validating, linting and evaluating Sigma detection rules"
readme = "README.md"
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
repository.workspace = true
homepage.workspace = true

[features]
default = ["daemon"]
daemon = ["rsigma-runtime", "tokio", "axum", "async-trait", "prometheus", "notify", "rusqlite"]
daemon-nats = ["daemon", "rsigma-runtime/nats", "async-nats", "tokio-stream", "time"]
daemon-otlp = ["daemon", "rsigma-runtime/otlp", "prost", "tonic", "flate2", "tokio-stream"]
logfmt = ["rsigma-runtime/logfmt"]
cef = ["rsigma-runtime/cef"]
evtx = ["rsigma-runtime/evtx"]
daachorse-index = ["rsigma-eval/daachorse-index", "rsigma-runtime?/daachorse-index"]

[dependencies]
rsigma-parser = { path = "../rsigma-parser", version = "0.11.0" }
rsigma-eval = { path = "../rsigma-eval", version = "0.11.0", features = ["parallel"] }
rsigma-convert = { path = "../rsigma-convert", version = "0.11.0" }
rsigma-runtime = { path = "../rsigma-runtime", version = "0.11.0", optional = true }
clap = { version = "4", features = ["derive", "env"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
serde_yaml = { package = "yaml_serde", version = "0.10" }
yamlpatch_yaml = { package = "serde_yaml", version = "0.9" }
jaq-interpret = "1.5.0"
jaq-parse = "1.0.3"
serde_json_path = "0.7.2"
jsonschema = "0.46"
ureq = "3"
dirs = "6"
yamlpath = "1.24"
yamlpatch = "1.24"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["json", "env-filter"] }
chrono = { version = "0.4", default-features = false, features = ["std", "now"] }

# daemon mode dependencies
tokio = { version = "1", features = ["full"], optional = true }
axum = { version = "0.8", features = ["json"], optional = true }
async-trait = { version = "0.1", optional = true }
prometheus = { version = "0.14", default-features = false, optional = true }
notify = { version = "8.2", optional = true }
rusqlite = { version = "0.39", features = ["bundled"], optional = true }
async-nats = { version = "0.47", optional = true }
tokio-stream = { version = "0.1", optional = true }
time = { version = "0.3", optional = true }
prost = { version = "0.14", optional = true }
tonic = { version = "0.14", features = ["gzip"], optional = true }
flate2 = { version = "1", optional = true }

[dev-dependencies]
assert_cmd = "2.1.2"
predicates = "3.1.4"
tempfile = "3.25.0"
insta = "1.46"
tokio = { version = "1", features = ["full"] }
async-nats = "0.47"
bytes = "1"
futures = "0.3"
testcontainers = "0.27"
testcontainers-modules = { version = "0.15", features = ["nats"] }
rusqlite = { version = "0.39", features = ["bundled"] }
serde_json = "1"
opentelemetry-proto = { version = "0.31", default-features = false, features = ["gen-tonic", "logs", "with-serde"] }
prost = "0.14"
flate2 = "1"
