Author Sigma detections in VS Code with the checks a senior detection engineer
makes by reflex — false-positive smells, ATT&CK validation, Sigma→KQL
compilation, and a backtest you can run without any cloud access — all in
the editor, before the rule ships.
Features
False-positive lints, live. Flags match-all fields, single-field
low-entropy selections, missing exclusion terms, and un-tagged rules as you type.
ATT&CK validation. Technique IDs are checked for format and existence, so
a bogus attack.t9999.001 gets a red squiggle instead of poisoning your
coverage story.
Sigma → KQL. Compile the current rule to table-qualified KQL
(Detection Copilot: Compile to KQL).
Offline backtest. Point detectionCopilot.sampleDataset at a JSONL of
synthetic or de-identified events and run
Detection Copilot: Backtest against sample events. Get hit count and fire
rate; noisy rules are flagged. No Log Analytics, no credentials, PHI-safe —
evaluation happens entirely on your machine and no log rows ever leave it.
Requirements
The intelligence runs in a small Python language server. Install it once:
pip install detection-copilot-server
The extension launches it automatically. If it isn't found, the extension tells
you how to install it rather than failing silently. To run the server from a
specific interpreter, set detectionCopilot.pythonPath.
Quick start
pip install detection-copilot-server
Open a .sigma.yml file (see examples/).
Edit — diagnostics appear live.
Set detectionCopilot.sampleDataset to examples/sample_events.jsonl.
Run Detection Copilot: Backtest against sample events from the palette.
Detections and sample events are processed locally. The offline backtest never
transmits log data anywhere. See the repository README for the full data-boundary
design.
